CVE-2024-58315 | THREATINT

Description

Tosibox Key Service 3.3.0 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code with elevated system privileges. Attackers can exploit the service startup process by inserting malicious code in the system root path, enabling unauthorized code execution during application startup or system reboot.

PUBLISHED Reserved 2025-12-12 | Published 2025-12-30 | Updated 2025-12-30 | Assigner VulnCheck

HIGH: 8.5CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

HIGH: 8.4CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem types

Unquoted Search Path or Element

Product status

Unknown (semver)

affected

Credits

LiquidWorm as Gjoko Krstic of Zero Science Lab finder

References

www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5812.php (Zero Science Lab Disclosure (ZSL-2024-5812)) third-party-advisory

packetstormsecurity.com/files/177260/ (Packet Storm Security Exploit Entry) exploit

www.tosi.net/ (Vendor Homepage) vendor-advisory

www.vulncheck.com/...ge-escalation-via-unquoted-service-path (VulnCheck Advisory: Tosibox Key Service 3.3.0 Local Privilege Escalation via Unquoted Service Path) third-party-advisory

cve.org (CVE-2024-58315)

nvd.nist.gov (CVE-2024-58315)

Download JSON