Internet Download Manager
Monthly
Local privilege escalation in Tonec Internet Download Manager (IDM) versions up to 6.42 Build 63 on Windows allows a low-privileged local attacker to gain full SYSTEM-level kernel control by exploiting improper access controls in the idmwfp.sys kernel driver (CWE-284). A public proof-of-concept exploit is available on GitHub under the repository name IDM_LPE_PoC, substantially lowering the barrier to exploitation. The vendor was notified prior to disclosure but did not respond, and no patch has been released at time of analysis.
Internet Download Manager 6.38.12 contains a buffer overflow vulnerability in the Scheduler component that allows local attackers to crash the application by supplying oversized input. Rated medium severity (CVSS 6.9), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Tonec Internet Download Manager 6.42.41.1 and earlier suffers from Missing SSL Certificate Validation, which allows attackers to bypass update protections. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Local privilege escalation in Tonec Internet Download Manager (IDM) versions up to 6.42 Build 63 on Windows allows a low-privileged local attacker to gain full SYSTEM-level kernel control by exploiting improper access controls in the idmwfp.sys kernel driver (CWE-284). A public proof-of-concept exploit is available on GitHub under the repository name IDM_LPE_PoC, substantially lowering the barrier to exploitation. The vendor was notified prior to disclosure but did not respond, and no patch has been released at time of analysis.
Internet Download Manager 6.38.12 contains a buffer overflow vulnerability in the Scheduler component that allows local attackers to crash the application by supplying oversized input. Rated medium severity (CVSS 6.9), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Tonec Internet Download Manager 6.42.41.1 and earlier suffers from Missing SSL Certificate Validation, which allows attackers to bypass update protections. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.