CVE-2021-42714
📋 TL;DR
Splashtop Remote Client (Business Edition) creates temporary files with insecure permissions, allowing local attackers to write arbitrary files to system directories. This affects all users running vulnerable versions of Splashtop Business Edition on Windows systems.
💻 Affected Systems
- Splashtop Remote Client (Business Edition)
📦 What is this software?
Splashtop by Splashtop
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation to SYSTEM-level access through arbitrary file writes to sensitive locations, potentially leading to full system compromise.
Likely Case
Local attackers can write malicious files to system directories, enabling persistence mechanisms or privilege escalation.
If Mitigated
With proper access controls and user privilege restrictions, impact limited to file writes in user-controlled directories.
🎯 Exploit Status
Exploitation requires local access to the system. Proof of concept details available in Mandiant disclosure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.4.8.4 and later
Vendor Advisory: https://www.splashtop.com/security
Restart Required: Yes
Instructions:
1. Download latest version from Splashtop Business portal. 2. Run installer as administrator. 3. Restart system after installation completes.
🔧 Temporary Workarounds
Restrict local access
allLimit physical and remote desktop access to trusted users only
Run with limited privileges
windowsConfigure Splashtop to run with standard user privileges instead of administrative rights
🧯 If You Can't Patch
- Remove Splashtop Business Edition from critical systems
- Implement strict access controls and monitoring for systems with vulnerable versions
🔍 How to Verify
Check if Vulnerable:
Check Splashtop version in About dialog or Program Files\Splashtop Remote Client Business\version.txtCheck Version:
wmic product where name="Splashtop Remote Client Business" get versionVerify Fix Applied:
Verify version is 3.4.8.4 or higher in About dialog📡 Detection & Monitoring
Log Indicators:
- Unusual file creation in system directories by Splashtop processes
- Multiple temporary file creation attempts
Network Indicators:
- Not applicable - local vulnerability
SIEM Query:
Process creation where parent_process contains "Splashtop" and command_line contains "temp" or file_path contains "system32"