Bug gives you admin rights when you plug in Razer device

Security researcher jonhat discovered a vulnerability in Razer's drivers that allows an attacker to gain admin rights on a Windows machine simply by plugging a Razer device into the PC. Windows Update will then download and execute RazerInstaller with SYSTEM privileges, allowing an attacker to open a Powershell prompt with Shift + right click. The PowerShell instance will then have the same SYSTEM privileges, allowing the execution of arbitrary code.

Bleeping Computer has extra details over here. It's a nasty bug but exploitation requires local access so the overall risk is relatively low.

It should be noted that this is a local privilege escalation (LPE) vulnerability, which means that you need to have a Razer devices and physical access to a computer. With that said, the bug is so easy to exploit as you just need to spend $20 on Amazon for Razer mouse and plug it into Windows 10 to become an admin.

Need local admin and have physical access?
- Plug a Razer mouse (or the dongle)
- Windows Update will download and execute RazerInstaller as SYSTEM
- Abuse elevated Explorer to open Powershell with Shift+Right click

Tried contacting @Razer, but no answers. So here's a freebie pic.twitter.com/xDkl87RCmz

— jonhat (@j0nh4t) August 21, 2021

Presumably, a lot of other manufacturers may have similar bugs. Will Dormann from CERT/CC speculates this is a vulnerability of the type 'how has nobody realized this before now?' Razer promises to issue a fix asap.

Many vulnerabilities fall into the class of "How has nobody realized this before now?"

If you combine the facts of "connecting USB automatically loads software" and "software installation happens with privileges", I'll wager that there are other exploitable packages out there...

— Will Dormann (@wdormann) August 22, 2021