High severity · published Sep 10, 2024
CVE-2024-8258
Insecure Electron Fuses in Logitech Options Plus Allowing Arbitrary Code Execution on macOS
7.8
CVSS
0.4%
EPSS
No
On KEV
Description
Improper Control of Generation of Code ('Code Injection') in Electron Fuses in Logitech Options Plus version 1.60.496306 on macOS allows attackers to execute arbitrary code via insecure Electron Fuses configuration.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LO
Logitech Options Plus · Logitech
1.60.496306 before 1.70 · source: vendor
LO
Logi Options+ · Logitech
1.60.496306 before 1.70.551909 · source: NVD
OP
Options Plus · Logitech
1.60.496306 before 1.70 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-8258
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-8258
Exploit
https://github.com/r3ggi/electroniz3r
Not Applicable
https://nvd.nist.gov/vuln/detail/CVE-2023-49314
Not Applicable
https://nvd.nist.gov/vuln/detail/CVE-2023-50643
Product
https://www.electronjs.org/docs/latest/tutorial/fuses