Security expert johnat discovered a “hole” in the software for the brand’s gaming peripherals Razer Synapse… It allows you to get administrator rights in Windows 10 or Windows 11 when you connect a manufacturer’s mouse or keyboard to your computer.
The utility is designed to update accessories and automatically downloads the executable file RazerInstaller.exe to your computer. The latter is launched with system privileges and prompts you to select a folder for unpacking files. If at this moment you press Shift and right-click, then you can open PowerShell with administrator rights. The user can then execute any commands on the system, since all child processes will also run with privileges.
Need local admin and have physical access?
– Plug a Razer mouse (or the dongle)
– Windows Update will download and execute RazerInstaller as SYSTEM
– Abuse elevated Explorer to open Powershell with Shift + Right clickTried contacting @Razer, but no answers. So here’s a freebie pic.twitter.com/xDkl87RCmz
– jonhat (@ j0nh4t) August 21, 2023
More than 100 million people are reported to have installed Razer Synapse software.
Read also: Microsoft has made it harder to choose the default browser in Windows 11…
