Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-12552: Wacom Center WTabletServicePro Escalates Privileges After Malicious Action

CVE-2024-12552 · published 1 year ago

Summary

A bug in Wacom Center's WTabletServicePro allows a local attacker to gain higher system privileges. This means an unauthorized user with some level of access to the computer can potentially take control of the system. To protect your system, update Wacom Center to the latest version.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
wacom	center	6.4.7.5003 `cpe:2.3:a:wacom:center:6.4.7.5003:::::::*`

Original advisory text

Wacom Center WTabletServicePro Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Wacom Center. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within WTabletServicePro.exe. By creating a symbolic link, an attacker can abuse the service to create an arbitrary file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-25359.

References

https://cdn.wacom.com/u/productsupport/drivers/win/professional/releasenotes/Win... Release Notes
https://www.zerodayinitiative.com/advisories/ZDI-24-1683/ Third Party Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

7.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-59Link Following

Timeline

Published13 Dec 2024

Updated29 Oct 2026

First seen7 Mar 2026

Sources

CVE-2024-12552 · NVD

Track software like this

Free during beta