title: Logitech Sync desktop application prior to 2.4.574 - TOCTOU during installation leads to privelege escalation
description: There is a Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability in Logitech Sync for Windows prior to 2.4.574. Successful exploitation of these vulnerabilities may escalate the permission to the system user.
problem types: CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
affected:
{
platforms: Windows
product: Sync
vendor: Logitech
versions:
lessThan: 2.4.574, status: affected, version: prior to 2.4.574, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
version: 3.1
]
solutions: Update to 2.4.574