What’s Vulnerable › Vulnerabilities

CVE-2022-0915: Logitech Sync desktop application prior to 2.4.574 - TOCTOU during installation leads to privelege escalation

• Severity: high (CVSS 7.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-04-12 · updated 2026-06-17
• Weakness: CWE-367

Description

There is a Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability in Logitech Sync for Windows prior to 2.4.574. Successful exploitation of these vulnerabilities may escalate the permission to the system user.

Affected products

• Logitech Sync: before 2.4.574 — fixed in 2.4.574

How to fix

Upgrade to a fixed version: Logitech Sync 2.4.574. Check the vendor advisory for mitigations.

References

• https://prosupport.logi.com/hc/en-us/articles/360040085114-Download-Logitech-Sync
• https://prosupport.logi.com/hc/en-us/articles/360040085114-Download-Logitech-Sync

Get alerted when CVE-2022-0915 or the next vulnerability affects your stack