High severity · published May 9, 2025
CVE-2024-13961
Avast Cleanup Premium TuneupSvc Link Following Local Privilege Escalation Vulnerability
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
Link Following Local Privilege Escalation Vulnerability in TuneupSvc in Avast Cleanup Premium Version 24.2.16593.17810 on Windows 10 Pro x64 allows local attackers to escalate privileges and execute arbitrary code in the context of SYSTEM via creating a symbolic link and leveraging a TOCTTOU (time-of-check to time-of-use) attack.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CP
CleanUp Premium · Avast
24.2.16593.17810 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-13961
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-13961
www.gendigital.com
https://www.gendigital.com/us/en/contact-us/security-advisories/
More from CleanUp Premium
7.8
CVE-2024-13962
Link Following Local Privilege Escalation Vulnerability in Avast Cleanup Premium Version 24.2.16593.17810
7.8
CVE-2024-7229
Avast Cleanup Premium Link Following Local Privilege Escalation Vulnerability
7.8
CVE-2024-7231
Avast Cleanup Premium Link Following Local Privilege Escalation Vulnerability
7.8
CVE-2024-7230
Avast Cleanup Premium Link Following Local Privilege Escalation Vulnerability