High severity7.8NVD Advisory· Published May 22, 2024· Updated Jun 17, 2026
CVE-2024-4454
CVE-2024-4454
Description
WithSecure Elements Endpoint Protection Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of WithSecure Elements Endpoint Protection. User interaction on the part of an administrator is required to exploit this vulnerability.
The specific flaw exists within the WithSecure plugin hosting service. By creating a symbolic link, an attacker can abuse the service to create a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-23035.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
6- cpe:2.3:a:withsecure:client_security:15:*:*:*:*:*:*:*
cpe:2.3:a:withsecure:elements_endpoint_protection:17:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:withsecure:elements_endpoint_protection:17:*:*:*:*:*:*:*
- (no CPE)
- cpe:2.3:a:withsecure:email_and_server_security:15:*:*:*:*:*:*:*
- cpe:2.3:a:withsecure:server_security:15:*:*:*:*:*:*:*
- WithSecure/Elementsv5Range: 23.9
Patches
Vulnerability mechanics
References
1- www.zerodayinitiative.com/advisories/ZDI-24-491/nvdThird Party Advisory
News mentions
0No linked articles in our index yet.