CVE-2023-3514
📋 TL;DR
This vulnerability allows local attackers to escalate privileges to SYSTEM level on Windows systems running vulnerable versions of RazerCentral. Attackers with low-privilege access can communicate with the RazerCentralService named pipe and execute arbitrary files. Only users with RazerCentral software installed are affected.
💻 Affected Systems
- Razer RazerCentral
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with SYSTEM privileges, allowing installation of persistent malware, credential theft, and full control of the affected system.
Likely Case
Local privilege escalation enabling attackers to bypass security controls, install additional malware, or access protected system resources.
If Mitigated
Limited to low-privilege user actions if proper access controls prevent unauthorized named pipe communication.
🎯 Exploit Status
Exploitation requires local low-privilege access. The advisory includes technical details that could be used to create exploits.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: >7.11.0.558
Vendor Advisory: https://starlabs.sg/advisories/23/23-3514/
Restart Required: Yes
Instructions:
1. Open Razer Central application
2. Check for updates in settings
3. Install any available updates
4. Restart the system
🔧 Temporary Workarounds
Disable RazerCentralService
windowsStop and disable the vulnerable service to prevent exploitation
sc stop RazerCentralService
sc config RazerCentralService start= disabled
Remove Named Pipe Access
windowsRestrict access to the vulnerable named pipe
icacls "\\.\pipe\RazerCentralService" /deny Everyone:(F)
🧯 If You Can't Patch
- Uninstall RazerCentral software completely
- Implement strict least privilege access controls to limit local user permissions
🔍 How to Verify
Check if Vulnerable:
Check RazerCentral version in application settings or via 'wmic product where name="Razer Central" get version'Check Version:
wmic product where name="Razer Central" get versionVerify Fix Applied:
Verify version is >7.11.0.558 and test named pipe access attempts fail for low-privilege users📡 Detection & Monitoring
Log Indicators:
- Unusual named pipe access attempts to RazerCentralService
- Process creation from RazerCentralService with SYSTEM privileges
- Failed privilege escalation attempts in security logs
Network Indicators:
- Local named pipe communication patterns
SIEM Query:
EventID=4688 AND NewProcessName="*RazerCentralService*" AND SubjectUserName!="SYSTEM"