Low · 2.0 CVE-2024-8258 EUVD-2024-49051GHSA-5hm7-x82q-99rh

Insecure Electron Fuses in Logitech Options Plus Allowing Arbitrary Code Execution on macOS

Published Sep 10, 2024 · Updated Sep 10, 2024 · Assigned by Logitech

Vendor: Logitech Product: Logitech Options Plus

Description

Improper Control of Generation of Code ('Code Injection') in Electron Fuses in Logitech Options Plus version 1.60.496306 on macOS allows attackers to execute arbitrary code via insecure Electron Fuses configuration.

Affected products

Vendor	Product	Affected	Fixed
Logitech	Logitech Options Plus	1.60.496306 – < 1.70	1.70

References

https://www.electronjs.org/docs/latest/tutorial/fuses
https://nvd.nist.gov/vuln/detail/CVE-2023-50643
https://nvd.nist.gov/vuln/detail/CVE-2023-49314
https://github.com/r3ggi/electroniz3r