Tosibox Key Service 3.3.0 Local Privilege Escalation via Unquoted Service Path (ZSL-2024-5812)

Vulnerability Key Information Vulnerability Title Tosibox Key Service 3.3.0 Local Privilege Escalation Vulnerability ID ZSL-2024-5812 Type Local Impact Privilege Escalation Risk Level 3/5 Release Date 23.02.2024 Vulnerability Description TOSIBOX® SoftKey software contains an unquoted search path vulnerability, affecting the "Tosibox Key Service" service deployed as part of the Tosibox software application on Windows systems. This could allow an authorized but non-privileged local user to execute arbitrary code with elevated privileges, thereby achieving privilege escalation. Vulnerability Vendor Tosibox Oy - https://www.tosibox.com Affected Versions <=3.3.0 Test Environment Windows 10 Home 64-bit (build 9200) Vendor Status January 30, 2024: Vulnerability discovered February 10, 2024: Vendor confirmed the vulnerability and began remediation February 23, 2024: Vendor released fixed version 3.3.1 February 23, 2024: Public security advisory published Reference Links 1. Metasploit module 2. Tosibox Support Page 3. Tosibox Security Advisory 4. Tosibox Key Software Releases 5. PacketStormSecurity 6. Tosibox Hall of Fame

Goal Reached Thanks to every supporter — we hit 100%!

Tosibox Key Service 3.3.0 Local Privilege Escalation via Unquoted Service Path (ZSL-2024-5812)