VULNERABILITY INTELLIGENCE

CVE-2018-19592

CVSS score7.8 HIGH

EPSS probability1.09%

CISA KEVNot currently listed

Published2019-09-27

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

The "CLink4Service" service is installed with Corsair Link 4.9.7.35 with insecure permissions by default. This allows unprivileged users to take control of the service and execute commands in the context of NT AUTHORITY\SYSTEM, leading to total system takeover, a similar issue to CVE-2018-12441.

Weakness classification

CWE-276: Incorrect Default Permissions

Primary references

cve@mitre.org — Release Notes, Vendor Advisory
cve@mitre.org — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory