Loading story…
STAR Labs disclosed two high-severity local privilege escalation vulnerabilities in Razer CentralService affecting Razer Central 7.11.0.558 and earlier. The bugs, tracked as CVE-2023-3513 and CVE-2023-3514, allow a low-privileged Windows user to execute code as SYSTEM through insecure service design in RazerCentralService.exe. One flaw stems from unsafe deserialization of ConnectedAccounts.bin, which is decrypted with a hardcoded AES-CBC key and processed with BinaryFormatter; the other involves unsafe handling of commands received over a broadly accessible named pipe.
According to the advisory, attackers can abuse user-writable paths under C:\ProgramData\Razer\Razer Central\Accounts and the service's permissive named pipe access to trigger privileged functionality. STAR Labs said the exposed UpdateManager interface includes commands such as AddModule and UninstallModules, which can be manipulated with malicious XML to create a fake module and launch an attacker-controlled binary as SYSTEM. The researchers reported exploitation can be triggered during login, restart, or directly through the named pipe, and recommended removing BinaryFormatter, tightening named pipe permissions, sanitizing untrusted input, and correcting directory permissions.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
STAR Labs published details of CVE-2023-3514, a local privilege escalation flaw in Razer Central versions 7.11.0.558 and below. The vulnerability involves unsafe handling of commands over a named pipe, enabling attackers to abuse privileged service functionality and run attacker-controlled code as SYSTEM.
STAR Labs published details of CVE-2023-3513, a local privilege escalation flaw in Razer Central versions 7.11.0.558 and below. The issue stems from insecure deserialization of a user-influenced ConnectedAccounts.bin file, allowing low-privileged users to execute code as SYSTEM.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
starlabs.sg
Open sourcestarlabs.sg
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Newly published CVEs detail **unquoted service path** vulnerabilities in two IObit products that can let a low-privileged local attacker gain **`LocalSystem`** execution. **CVE-2016-20055** affects **IObit Advanced SystemCare 10.0.2**, specifically the `AdvancedSystemCareService10` service, while **CVE-2016-20059** affects **IObit Malware Fighter 4.3.1** through the `IMFservice` and `LiveUpdateSvc` services. Both issues are classified as **CWE-428** and carry high-severity CVSS v3.1 and v4.0 ratings reflecting potential impact to confidentiality, integrity, and availability. In both cases, an attacker with local access can place a malicious executable in a vulnerable service path and wait for the affected service to restart or for the system to reboot, at which point the payload may run with elevated privileges. The Malware Fighter entry cites supporting references including IObit product pages, an **Exploit-DB** listing, and a **VulnCheck** advisory, while both CVEs were recorded through disclosures submitted to **disclosure@vulncheck.com**.
Jun 29, 2026
A high-severity local privilege-escalation vulnerability, **CVE-2026-50610**, affects Acer's System Monitor engine used by NitroSense and PredatorSense on Windows laptops. Vulnerable `AcerSysHardwareService.exe` versions 1.0.1018.13 and 1.0.1019.0, associated with the NitroSense 5.1.361 engine, run as `LocalSystem` while exposing named pipes that authenticated standard users can access without adequate authorization or client impersonation checks. The service's pipe protocol permits arbitrary registry operations as `SYSTEM`, including writes under `HKLM`. A proof of concept registers `cmd.exe` as the debugger for `utilman.exe`, allowing an attacker with local standard-user access to obtain a pre-login `NT AUTHORITY\SYSTEM` shell through Windows accessibility functionality. The issue was privately reported to Acer in May 2026; the available reports do not identify a patch, mitigation, or confirmed exploitation in the wild.
Oct 1, 2026
RATOC Systems' **RAID Monitoring Manager for Windows** is affected by two high-severity installer vulnerabilities that can let attackers execute arbitrary code with elevated privileges. **`CVE-2026-32680`** is a local privilege escalation flaw tied to custom installation paths: when the software is installed outside the default directory, insecure ACLs can leave the target folder writable by non-administrative users, creating a path to **SYSTEM-level** code execution. The issue is classified as **`CWE-276`** and carries high impact across confidentiality, integrity, and availability. A second flaw, **`CVE-2026-28760`**, affects the same installer through improper DLL loading. The installer searches the current directory for certain DLLs, so an attacker who places a crafted DLL next to the installer and convinces a user to run it can achieve arbitrary code execution with **administrator privileges**. That issue is classified as **`CWE-427`**, and both vulnerabilities were published through JPCERT/JVN-linked advisories and RATOC references as high-severity Windows privilege-escalation risks.
Jun 29, 2026