CVE-2024-22002

HIGH

CORSAIR iCUE <5.9.105 - Code Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2024-22002. PoCs published by 0xkickit.

AI-analyzed exploit summary The repository provides a functional DLL hijacking exploit for CVE-2024-22002 in CORSAIR iCUE v5.9.105, where a malicious DLL can be placed in the `cuepkg-1.2.6` directory to achieve local privilege escalation (LPE) via the `iCUEUpdateService`.

Description

CORSAIR iCUE 5.9.105 with iCUE Murals on Windows allows unprivileged users to insert DLL files in the cuepkg-1.2.6 subdirectory of the installation directory.

Exploits (1)

nomisec WORKING POC
by 0xkickit · poc
https://github.com/0xkickit/iCUE_DllHijack_LPE-CVE-2024-22002

The repository provides a functional DLL hijacking exploit for CVE-2024-22002 in CORSAIR iCUE v5.9.105, where a malicious DLL can be placed in the `cuepkg-1.2.6` directory to achieve local privilege escalation (LPE) via the `iCUEUpdateService`.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Trivial
Reliability
Reliable
Target: CORSAIR iCUE v5.9.105
Auth required
Prerequisites: Write access to the `cuepkg-1.2.6` directory · iCUE v5.9.105 installed
MITRE ATT&CK
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 7.8
EPSS 0.0044
EPSS Percentile 35.0%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-200
Status published
Published Jun 18, 2024
Tracked Since Feb 18, 2026