CVE-2018-7884 An issue was discovered in DisplayLink Core Software Cleaner Application 8.2.1956. When the drivers are updated to a newer version, the product launches a process as SYSTEM to uninstall the old versio...
HighCVSS 7.8
EPSS 0.91%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue was discovered in DisplayLink Core Software Cleaner Application 8.2.1956. When the drivers are updated to a newer version, the product launches a process as SYSTEM to uninstall the old version: cl_1956.exe is run as SYSTEM on the %systemroot%\Temp folder, where any user can write a DLL (e.g., version.dll) to perform DLL Hijacking and elevate privileges to SYSTEM.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| displaylink core software cleaner | = 8.2.1956 | No fix listed |
References
- 20180601 DisplayLink Installer 8.2.1956 DLL Hijack to privilege escalation CVE-2018-7884 mailing-list third-party-advisory