CVE-2020-10551

HIGH

QQBrowser <10.5.3870.400 - Privilege Escalation

Title source: llm
STIX 2.1

Description

QQBrowser before 10.5.3870.400 installs a Windows service TsService.exe. This file is writable by anyone belonging to the NT AUTHORITY\Authenticated Users group, which includes all local and remote users. This can be abused by local attackers to escalate privileges to NT AUTHORITY\SYSTEM by writing a malicious executable to the location of TsService.

Exploits (1)

nomisec WORKING POC 1 stars
by seqred-s-a · poc
https://github.com/seqred-s-a/CVE-2020-10551

References (2)

Core 2
Core References
Third Party Advisory x_refsource_misc
https://github.com/seqred-s-a/CVE-2020-10551

Scores

CVSS v3 7.8
EPSS 0.0960
EPSS Percentile 92.9%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-732
Status published
Products (1)
tencent/qqbrowser < 10.5.3870.400
Published Apr 09, 2020
Tracked Since Feb 18, 2026