« Volver al listado

CVE-2023-3181

Estado: AnalizadaAlta (7.8)—

The C:\Program Files (x86)\Splashtop\Splashtop Software Updater\uninst.exe process creates a folder at C:\Windows\Temp~nsu.tmp and copies itself to it as Au_.exe. The C:\Windows\Temp~nsu.tmp\Au_.exe file is automatically launched as SYSTEM when the system reboots or when a standard user runs an MSI repair using Splashtop Streamer’s Windows Installer. Since the C:\Windows\Temp~nsu.tmp folder inherits permissions from C:\Windows\Temp and Au_.exe is susceptible to DLL hijacking, standard users can write a malicious DLL to it and elevate their privileges.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (5)

Splashtop — Mirroring360 ReceiverSplashtop — Mirroring360 SenderSplashtop — SplashtopSplashtop — Splashtop FOR RMMSplashtop — Streamer

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-3181",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-3181",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-06-03T18:21:45.344343Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve-coordination@google.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve-coordination@google.com",
      "affectedData": [
        {
          "vendor": "Splashtop",
          "product": "Splashtop Software Updater",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.5.6.21",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-01-25T16:15:07.400",
  "references": [
    {
      "url": "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0015.md",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve-coordination@google.com"
    },
    {
      "url": "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0015.md",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve-coordination@google.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-379"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The C:\\Program Files (x86)\\Splashtop\\Splashtop Software Updater\\uninst.exe process creates a folder at C:\\Windows\\Temp~nsu.tmp and copies itself to it as Au_.exe. The C:\\Windows\\Temp~nsu.tmp\\Au_.exe file is automatically launched as SYSTEM when the system reboots or when a standard user runs an MSI repair using Splashtop Streamer’s Windows Installer. Since the C:\\Windows\\Temp~nsu.tmp folder inherits permissions from C:\\Windows\\Temp and Au_.exe is susceptible to DLL hijacking, standard users can write a malicious DLL to it and elevate their privileges."
    },
    {
      "lang": "es",
      "value": "El proceso C:\\Program Files (x86)\\Splashtop\\Splashtop Software Updater\\uninst.exe crea una carpeta en C:\\Windows\\Temp~nsu.tmp y se copia en ella como Au_.exe. El archivo C:\\Windows\\Temp~nsu.tmp\\Au_.exe se inicia automáticamente como SISTEMA cuando el sistema se reinicia o cuando un usuario estándar ejecuta una reparación de MSI utilizando el instalador de Windows de Splashtop Streamer. Dado que la carpeta C:\\Windows\\Temp~nsu.tmp hereda permisos de C:\\Windows\\Temp y Au_.exe es susceptible al secuestro de DLL, los usuarios estándar pueden escribirle una DLL maliciosa y elevar sus privilegios."
    }
  ],
  "lastModified": "2026-06-17T06:13:31.850",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:splashtop:mirroring360_receiver:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6563A7D7-1B53-45F6-889E-5268473A0C1D",
              "versionEndExcluding": "2.4.0.1"
            },
            {
              "criteria": "cpe:2.3:a:splashtop:mirroring360_sender:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3FCC4A5A-FA91-44A6-AEF7-AA7152924290",
              "versionEndExcluding": "1.3.0.0"
            },
            {
              "criteria": "cpe:2.3:a:splashtop:splashtop:*:*:*:*:business:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "746D321B-BF0D-48A9-98A0-82A5083902E1",
              "versionEndExcluding": "3.5.6.0"
            },
            {
              "criteria": "cpe:2.3:a:splashtop:splashtop:*:*:*:*:personal:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C45B532F-DE36-4E00-BF68-D03A44428D0B",
              "versionEndExcluding": "3.5.8.0"
            },
            {
              "criteria": "cpe:2.3:a:splashtop:splashtop_for_rmm:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "444CA138-705C-433C-9D79-2A013D581464",
              "versionEndExcluding": "3.5.8.0"
            },
            {
              "criteria": "cpe:2.3:a:splashtop:streamer:*:*:*:*:-:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "38D5C0BB-40D8-4E05-9C4C-297D2B047B3C",
              "versionEndExcluding": "3.5.6.0"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cve-coordination@google.com"
}