Loading vulnerability…
CVE-2020-7352 is a local privilege escalation vulnerability in the GOG Galaxy client (versions 1.2.64 and 2.0.12.48 and earlier) for Windows. The GalaxyClientService component runs with SYSTEM privileges and listens on localhost:9978. The service uses a binary protocol with HMAC-SHA512 authentication, but the secret key is statically embedded in the executable. An attacker with local access and knowledge of the key can send arbitrary commands to the service, which are executed as SYSTEM. Proof-of-concept exploits, including a Metasploit module, are publicly available. Additionally, insecure file permissions on SQLite database files could allow further privilege escalation or data exposure.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a single Metasploit module (Ruby file) that exploits a local privilege escalation vulnerability (CVE-2020-7352) in the GOG GalaxyClientService on Windows. The exploit targets GOG Galaxy Client versions 1.2.62 and 2.0.12 (and likely earlier), allowing an attacker with a Meterpreter session to execute arbitrary files as SYSTEM. The module works by dropping a custom payload (typically a Meterpreter reverse shell EXE) to a specified path (default: %TEMP%), then communicating with the GalaxyClientService over a local TCP socket (127.0.0.1:9978) to instruct it to execute the payload with SYSTEM privileges. The module includes checks for the presence and version of the service, and uses HMAC-SHA512 to sign the command sent to the service. The exploit is operational and provides reliable privilege escalation on vulnerable systems. The only file in the repository is the Metasploit module itself, written in Ruby.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
No public activity tracked yet. Mallory keeps watching.
No public activity observed for this vulnerability.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.