{"id":"CVE-2024-13959","state":"PUBLISHED","title":"Link Following Local Privilege Escalation Vulnerability in AVG TuneUp 24.2.16593.9844","description":"Link Following Local Privilege Escalation Vulnerability in TuneupSvc.exe in AVG TuneUp 24.2.16593.9844 on Windows allows local attackers to escalate privileges and execute arbitrary code in the context of SYSTEM via creating a symbolic link and leveraging the service to delete a directory","publishedAt":"2025-05-09T15:20:18.308Z","updatedAt":"2025-05-09T19:02:14.584Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"NLOK"},"assigner":"NLOK","products":["AVG TuneUp"],"affected":[{"vendor":"AVG","product":"TuneUp","defaultStatus":"affected","versions":[{"version":"24.2.16593.9844","status":"affected"},{"version":"24.3.17165.10564","status":"unaffected"}],"platforms":["Windows","64 bit"]}],"references":["https://www.gendigital.com/us/en/contact-us/security-advisories/"],"weaknesses":["CWE-59"],"ingestedAt":"2026-10-29T20:06:50.777Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/13xxx/CVE-2024-13959.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-13959","state":"PUBLISHED","datePublished":"2025-05-09T15:20:18.308Z","dateUpdated":"2025-05-09T19:02:14.584Z","assignerShortName":"NLOK","assignerOrgId":"dbd8429d-f261-4b1e-94cc-ae3132817e2e","dateReserved":"2025-05-09T14:11:28.564Z"},"containers":{"cna":{"title":"Link Following Local Privilege Escalation Vulnerability in AVG TuneUp 24.2.16593.9844","descriptions":[{"lang":"en","value":"Link Following Local Privilege Escalation Vulnerability in TuneupSvc.exe in AVG TuneUp 24.2.16593.9844 on Windows allows local attackers to escalate privileges and execute arbitrary code in the context of SYSTEM via creating a symbolic link and leveraging the service to delete a directory"}],"affected":[{"vendor":"AVG","product":"TuneUp","defaultStatus":"affected","versions":[{"version":"24.2.16593.9844","status":"affected"},{"version":"24.3.17165.10564","status":"unaffected"}],"platforms":["Windows","64 bit"]}],"references":[{"url":"https://www.gendigital.com/us/en/contact-us/security-advisories/"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-59","description":"CWE-59 Improper Link Resolution Before File Access ('Link Following')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"NLOK","orgId":"dbd8429d-f261-4b1e-94cc-ae3132817e2e","dateUpdated":"2025-05-09T15:20:18.308Z"},"credits":[{"lang":"en","type":"finder","value":"Vladislav Berghici of Trend Micro"},{"lang":"en","type":"reporter","value":"Zero Day Initiative"}],"impacts":[{"capecId":"CAPEC-233","descriptions":[{"lang":"en","value":"CAPEC-233 Privilege Escalation"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<span style=\"background-color: rgb(255, 255, 255);\">An upgrade was released on 11.12.2024 in version AVG TuneUp 24.3.17165.10564, upgrade to this or later version.</span><br>"}],"value":"An upgrade was released on 11.12.2024 in version AVG TuneUp 24.3.17165.10564, upgrade to this or later version."}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-05-09T18:58:19.475331Z","id":"CVE-2024-13959","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-05-09T19:02:14.584Z"}}]}}}