Vulnerabilities > Razer
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-09-14 | CVE-2022-47631 | Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Razer Synapse Razer Synapse through 3.7.1209.121307 allows privilege escalation due to an unsafe installation path and improper privilege management. | 7.8 |
| 2023-07-14 | CVE-2023-3513 | Improper Privilege Management vulnerability in Razer Central Improper Privilege Control in RazerCentralSerivce Named Pipe in Razer RazerCentral <=7.11.0.558 on Windows allows a malicious actor with local access to gain SYSTEM privilege via communicating with the named pipe as a low-privilege user and triggering an insecure .NET deserialization. | 7.8 |
| 2023-07-14 | CVE-2023-3514 | Improper Privilege Management vulnerability in Razer Central Improper Privilege Control in RazerCentralSerivce Named Pipe in Razer RazerCentral <=7.11.0.558 on Windows allows a malicious actor with local access to gain SYSTEM privilege via communicating with the named pipe as a low-privilege user and calling "AddModule" or "UninstallModules" command to execute arbitrary executable file. | 7.8 |
| 2023-02-27 | CVE-2022-45697 | Link Following vulnerability in Razer Central Arbitrary File Delete vulnerability in Razer Central before v7.8.0.381 when handling files in the Accounts directory. | 7.8 |
| 2023-01-27 | CVE-2022-47632 | Uncontrolled Search Path Element vulnerability in Razer Synapse Razer Synapse before 3.7.0830.081906 allows privilege escalation due to an unsafe installation path, improper privilege management, and improper certificate validation. | 6.8 |
| 2022-06-09 | CVE-2022-29013 | OS Command Injection vulnerability in Razer Sila Firmware 2.0.441Api2.0.418 A command injection in the command parameter of Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to execute arbitrary commands via a crafted POST request. | 9.8 |
| 2022-06-09 | CVE-2022-29014 | Unspecified vulnerability in Razer Sila Firmware 2.0.441Api2.0.418 A local file inclusion vulnerability in Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to read arbitrary files. | 5.0 |
| 2022-03-23 | CVE-2021-44226 | Uncontrolled Search Path Element vulnerability in Razer Synapse Razer Synapse before 3.7.0228.022817 allows privilege escalation because it relies on %PROGRAMDATA%\Razer\Synapse3\Service\bin even if %PROGRAMDATA%\Razer has been created by any unprivileged user before Synapse is installed. | 7.3 |
| 2020-09-02 | CVE-2020-16602 | Race Condition vulnerability in Razer Chroma SDK Razer Chroma SDK Rest Server through 3.12.17 allows remote attackers to execute arbitrary programs because there is a race condition in which a file created under "%PROGRAMDATA%\Razer Chroma\SDK\Apps" can be replaced before it is executed by the server. | 8.1 |
| 2019-07-09 | CVE-2019-13142 | Incorrect Permission Assignment for Critical Resource vulnerability in Razer Surround 1.1.63.0 The RzSurroundVADStreamingService (RzSurroundVADStreamingService.exe) in Razer Surround 1.1.63.0 runs as the SYSTEM user using an executable located in %PROGRAMDATA%\Razer\Synapse\Devices\Razer Surround\Driver\. | 6.6 |