11 matches found
CVE-2026-30332
CVE-2026-30332 描述 在 Balena Etcher for Windows 2.1.4 之前的版本中发现了一个时间检查到时间使用（TOCTOU）漏洞。 该应用程序会在用户可写目录中创建一个临时 .cmd 文件，随后通过 UAC 以提升权限执行该文件。 这允许在当前用户上下文中以中等完整性 运行的应用程序或进程，通过在临时脚本执行前注入恶意命令，将权限提升至高完整性 。 技术分析 当用户启动烧录过程时，Etcher 会执行以下步骤： 1. 在用户可写的临时目录中创建一个临时 .cmd 文件： C:\Users\AppData\Local\Temp\etcher\ 2...
CVE-2026-30332
A Time-of-Check to Time-of-Use TOCTOU race condition vulnerability in Balena Etcher for Windows prior to v2.1.4 allows attackers to escalate privileges and execute arbitrary code via replacing a legitimate script with a crafted payload during the flashing process...
EUVD-2026-18350
A Time-of-Check to Time-of-Use TOCTOU race condition vulnerability in Balena Etcher for Windows prior to v2.1.4 allows attackers to escalate privileges and execute arbitrary code via replacing a legitimate script with a crafted payload during the flashing process...
CVE-2026-30332
A Time-of-Check to Time-of-Use TOCTOU race condition vulnerability in Balena Etcher for Windows prior to v2.1.4 allows attackers to escalate privileges and execute arbitrary code via replacing a legitimate script with a crafted payload during the flashing process...
CVE-2026-30332
A Time-of-Check to Time-of-Use TOCTOU race condition vulnerability in Balena Etcher for Windows prior to v2.1.4 allows attackers to escalate privileges and execute arbitrary code via replacing a legitimate script with a crafted payload during the flashing process...
CVE-2026-30332: Time-of-check Time-of-use (TOCTOU) Race Condition
A Time-of-Check to Time-of-Use TOCTOU race condition vulnerability in Balena Etcher for Windows prior to v2.1.4 allows attackers to escalate privileges and execute arbitrary code via replacing a legitimate script with a crafted payload during the flashing process...
CVE-2026-30332
Balena Etcher for Windows versions before 2.1.4 is vulnerable to a TOCTOU race during flashing. An attacker can replace a temporary .cmd file created in a user-writable temp directory with a crafted payload, which is then executed with elevated privileges via Windows UAC, allowing privilege escal...
CVE-2026-30332
A Time-of-Check to Time-of-Use TOCTOU race condition vulnerability in Balena Etcher for Windows prior to v2.1.4 allows attackers to escalate privileges and execute arbitrary code via replacing a legitimate script with a crafted payload during the flashing process...
CVE-2026-30332
A Time-of-Check to Time-of-Use TOCTOU race condition vulnerability in Balena Etcher for Windows prior to v2.1.4 allows attackers to escalate privileges and execute arbitrary code via replacing a legitimate script with a crafted payload during the flashing process...
PT-2026-29795
A Time-of-Check to Time-of-Use TOCTOU race condition vulnerability in Balena Etcher for Windows prior to v2.1.4 allows attackers to escalate privileges and execute arbitrary code via replacing a legitimate script with a crafted payload during the flashing process...
