8.6High

CVE-2024-9493Uncontrolled search path can lead to DLL hijacking in ToolStick installer

silabs.com ToolStick Published: 2025-01-24 17:28 (1 year ago)

Description

DLL hijacking vulnerabilities, caused by an uncontrolled search path in the ToolStick installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.

Weakness (CWE): CWE-427

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
silabs.com	ToolStick	≤ 2.60.1

References and patches

https://community.silabs.com/068Vm00000JUQwd vendor-advisorypermissions-required

CVSS score

8.6High

Source: Silabs · CVSS 3.1

Attack vector: Local
Attack complexity: Low
Privileges required: None
User interaction: Required
Scope: Changed
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

All scores (2)

cna	CVSS 3.1	8.6High
product-security@silabs.com	CVSS 3.1	8.6High

EPSS (chance of exploitation in 30 days)

0.19%

higher than 8% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: no
Technical impact: total

Timeline

ID reserved2024-10-03
Published2025-01-24 17:28
Reached IP-DB2026-10-24 23:56
Last updated2026-06-17 11:24

Assigned by (CNA): Silabs
NVD status: Deferred

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time