Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    2 vulnerabilities found for Logitech Options Plus by Logitech

    CVE-2024-8258 (GCVE-0-2024-8258)

    Vulnerability from cvelistv5 – Published: 2024-09-10 08:36 – Updated: 2024-09-10 13:56 X_Electron X_Code Injection X_Macos
    VLAI
    Title
    Insecure Electron Fuses in Logitech Options Plus Allowing Arbitrary Code Execution on macOS
    Summary
    Improper Control of Generation of Code ('Code Injection') in Electron Fuses in Logitech Options Plus version 1.60.496306 on macOS allows attackers to execute arbitrary code via insecure Electron Fuses configuration.
    Severity
    2 (Low)
    CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L/AU:Y/R:U
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-94 - Improper Control of Generation of Code ('Code Injection')
    Assigner
    References
    Impacted products
    Vendor Product Version
    Logitech Logitech Options Plus Affected: 1.60.496306 , < 1.70 (semver)
    Unaffected: 1.70
    		Create a notification for this product.
    logitech options_plus Affected: 1.60.496306 , < 1.70 (semver)
        cpe:2.3:a:logitech:options_plus:*:*:*:*:*:*:*:*
    		 Create a notification for this product.
    Date Public
    2024-08-30 07:29
    Credits
    Dave F - https://hackerone.com/dave23p
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:logitech:options_plus:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "options_plus",
            "vendor": "logitech",
            "versions": [
              {
                "lessThan": "1.70",
                "status": "affected",
                "version": "1.60.496306",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-8258",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T13:54:25.415583Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-10T13:56:50.325Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "MacOS"
          ],
          "product": "Logitech Options Plus",
          "vendor": "Logitech",
          "versions": [
            {
              "lessThan": "1.70",
              "status": "affected",
              "version": "1.60.496306",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.70"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Dave F - https://hackerone.com/dave23p"
        }
      ],
      "datePublic": "2024-08-30T07:29:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Control of Generation of Code (\u0027Code Injection\u0027) in Electron Fuses in Logitech Options Plus version 1.60.496306 on macOS allows attackers to execute arbitrary code via insecure Electron Fuses configuration.\u003cbr\u003e"
            }
          ],
          "value": "Improper Control of Generation of Code (\u0027Code Injection\u0027) in Electron Fuses in Logitech Options Plus version 1.60.496306 on macOS allows attackers to execute arbitrary code via insecure Electron Fuses configuration."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-242",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-242 Code Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "YES",
            "Recovery": "USER",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 2,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L/AU:Y/R:U",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-10T08:36:34.326Z",
        "orgId": "b573e801-1dd3-4adf-bd73-c9b814fbe067",
        "shortName": "Logitech"
      },
      "references": [
        {
          "url": "https://www.electronjs.org/docs/latest/tutorial/fuses"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50643"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49314"
        },
        {
          "url": "https://github.com/r3ggi/electroniz3r"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpdate to Logitech Options Plus version 1.70 or later.\u003c/p\u003e\u003cbr\u003e"
            }
          ],
          "value": "Update to Logitech Options Plus version 1.70 or later."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "tags": [
        "x_Electron",
        "x_Code Injection",
        "x_macOS"
      ],
      "title": "Insecure Electron Fuses in Logitech Options Plus Allowing Arbitrary Code Execution on macOS",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b573e801-1dd3-4adf-bd73-c9b814fbe067",
    "assignerShortName": "Logitech",
    "cveId": "CVE-2024-8258",
    "datePublished": "2024-09-10T08:36:34.326Z",
    "dateReserved": "2024-08-28T08:47:03.078Z",
    "dateUpdated": "2024-09-10T13:56:50.325Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2024-8258 (GCVE-0-2024-8258)

    Vulnerability from nvd – Published: 2024-09-10 08:36 – Updated: 2024-09-10 13:56 X_Electron X_Code Injection X_Macos
    VLAI
    Title
    Insecure Electron Fuses in Logitech Options Plus Allowing Arbitrary Code Execution on macOS
    Summary
    Improper Control of Generation of Code ('Code Injection') in Electron Fuses in Logitech Options Plus version 1.60.496306 on macOS allows attackers to execute arbitrary code via insecure Electron Fuses configuration.
    Severity
    2 (Low)
    CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L/AU:Y/R:U
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-94 - Improper Control of Generation of Code ('Code Injection')
    Assigner
    References
    Impacted products
    Vendor Product Version
    Logitech Logitech Options Plus Affected: 1.60.496306 , < 1.70 (semver)
    Unaffected: 1.70
    		Create a notification for this product.
    logitech options_plus Affected: 1.60.496306 , < 1.70 (semver)
        cpe:2.3:a:logitech:options_plus:*:*:*:*:*:*:*:*
    		 Create a notification for this product.
    Date Public
    2024-08-30 07:29
    Credits
    Dave F - https://hackerone.com/dave23p
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:logitech:options_plus:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "options_plus",
            "vendor": "logitech",
            "versions": [
              {
                "lessThan": "1.70",
                "status": "affected",
                "version": "1.60.496306",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-8258",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T13:54:25.415583Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-10T13:56:50.325Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "MacOS"
          ],
          "product": "Logitech Options Plus",
          "vendor": "Logitech",
          "versions": [
            {
              "lessThan": "1.70",
              "status": "affected",
              "version": "1.60.496306",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.70"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Dave F - https://hackerone.com/dave23p"
        }
      ],
      "datePublic": "2024-08-30T07:29:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Control of Generation of Code (\u0027Code Injection\u0027) in Electron Fuses in Logitech Options Plus version 1.60.496306 on macOS allows attackers to execute arbitrary code via insecure Electron Fuses configuration.\u003cbr\u003e"
            }
          ],
          "value": "Improper Control of Generation of Code (\u0027Code Injection\u0027) in Electron Fuses in Logitech Options Plus version 1.60.496306 on macOS allows attackers to execute arbitrary code via insecure Electron Fuses configuration."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-242",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-242 Code Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "YES",
            "Recovery": "USER",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 2,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L/AU:Y/R:U",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-10T08:36:34.326Z",
        "orgId": "b573e801-1dd3-4adf-bd73-c9b814fbe067",
        "shortName": "Logitech"
      },
      "references": [
        {
          "url": "https://www.electronjs.org/docs/latest/tutorial/fuses"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50643"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49314"
        },
        {
          "url": "https://github.com/r3ggi/electroniz3r"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpdate to Logitech Options Plus version 1.70 or later.\u003c/p\u003e\u003cbr\u003e"
            }
          ],
          "value": "Update to Logitech Options Plus version 1.70 or later."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "tags": [
        "x_Electron",
        "x_Code Injection",
        "x_macOS"
      ],
      "title": "Insecure Electron Fuses in Logitech Options Plus Allowing Arbitrary Code Execution on macOS",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b573e801-1dd3-4adf-bd73-c9b814fbe067",
    "assignerShortName": "Logitech",
    "cveId": "CVE-2024-8258",
    "datePublished": "2024-09-10T08:36:34.326Z",
    "dateReserved": "2024-08-28T08:47:03.078Z",
    "dateUpdated": "2024-09-10T13:56:50.325Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}