CVE-2024-24722

The vulnerability results from improper specification of the path to the Windows service executable without using quotes (unquoted service path, CWE-428). When the path contains spaces and is not enclosed in quotes, the Windows system during service startup may inadvertently execute a different file placed by an attacker in an earlier segment of the path. An attacker who manages to place a malicious executable file in the appropriate location can cause it to be executed in the context of a Windows system service, often with high privileges.

An attacker can obtain elevated privileges in the operating system, which in practice can lead to privilege escalation and takeover of server control. Both confidentiality and data integrity are at risk.

The software should be updated to version 4.3.10.192, 5.1.5.221, or 5.1.6.235, in which the vendor fixed the vulnerability. Patches and details are available at https://help.12dsynergy.com/v1/docs/cve-2024-24722 and on the vendor's website https://www.12dsynergy.com/security-statement/.

12d Synergy Server and 12d Synergy File Replication Server in all versions preceding 4.3.10.192, 5.1.5.221, and 5.1.6.235.