Logitech Sync desktop application prior to 2.4.574 - TOCTOU during installation leads to privelege escalation
Priority LOW 30CWE-367Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
There is a Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability in Logitech Sync for Windows prior to 2.4.574. Successful exploitation of these vulnerabilities may escalate the permission to the system user.
Why it matters now
EPSS 0.00175 7th percentileScored 2026-11-07
Fix Fixed Sync (Logitech): 2.4.574
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| LOGITEC CORPORATION | Sync | prior to 2.4.574 to before 2.4.574 | 2.4.574 | Patch available | CNA |
- Sync VendorLOGITEC CORPORATION Affected prior to 2.4.574 to before 2.4.574 Fixed in 2.4.574 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:logitech:sync:*:*:*:*:*:windows:*:* | before 2.4.574 | Vulnerable | LOGITEC CORPORATION |
- cpe:2.3:a:logitech:sync:*:*:*:*:*:windows:*:* Versions before 2.4.574 Vulnerable ·LOGITEC CORPORATION
Remediation
- Fix · CNA Sync (Logitech) Fixed in 2.4.574
Timeline
- 2026-10-02 Threatist record created from CVE-2022-0915
- 2026-10-03 Alias added: GHSA-gjm2-49fm-q537
References
Sources
- CVE-2022-0915 · CVE Program
- CVE-2022-0915 · NVD
- FIRST EPSS
- GHSA-gjm2-49fm-q537 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences