Logi Options
Monthly
Logitech's Logi Options+ updater service on Windows mishandles service-level privileges (CWE-269), exposing an attack surface that any authenticated local user can abuse to obtain a SYSTEM shell. With a proof-of-concept publicly documented on the amberwolf security blog, the exploitation barrier is minimal for any adversary already present on a Windows endpoint running the software. Organizations with broad Logitech peripheral deployments face meaningful privilege escalation risk if this path is chained with initial access obtained via phishing or credential compromise.
Improper Control of Generation of Code ('Code Injection') in Electron Fuses in Logitech Options Plus version 1.60.496306 on macOS allows attackers to execute arbitrary code via insecure Electron. Rated low severity (CVSS 2.0), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Logitech's Logi Options+ updater service on Windows mishandles service-level privileges (CWE-269), exposing an attack surface that any authenticated local user can abuse to obtain a SYSTEM shell. With a proof-of-concept publicly documented on the amberwolf security blog, the exploitation barrier is minimal for any adversary already present on a Windows endpoint running the software. Organizations with broad Logitech peripheral deployments face meaningful privilege escalation risk if this path is chained with initial access obtained via phishing or credential compromise.
Improper Control of Generation of Code ('Code Injection') in Electron Fuses in Logitech Options Plus version 1.60.496306 on macOS allows attackers to execute arbitrary code via insecure Electron. Rated low severity (CVSS 2.0), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.