CVE-2020-7352: gog galaxy
Vulnerability summary
CVE-2020-7352 is a high (CVSS 8.8) vulnerability in gog galaxy. EPSS estimates a 3.78% chance of exploitation in the next 30 days, higher than 89.8% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 06-08-2020PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
The GalaxyClientService component of GOG Galaxy runs with elevated SYSTEM privileges in a Windows environment. Due to the software shipping with embedded, static RSA private key, an attacker with this key material and local user permissions can effectively send any operating system command to the service for execution in this elevated context. The service listens for such commands on a locally-bound network port, localhost:9978. A Metasploit module has been published which exploits this vulnerability. This issue affects the 2.0.x branch of the software (2.0.12 and earlier) as well as the 1.2.x branch (1.2.64 and earlier). A fix was issued for the 2.0.x branch of the affected software.
CVSS metrics
3 scores · 2 sources · 2 versions- CVE.orgCNA8.4HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:NDiffers
EPSS trend
Probability
3.78%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
0.00 pp
From 3.78% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (positronsecurity.com)
Maturity: unknown
GOG GalaxyClientService Privilege Escalation
exploit/windows/local/gog_galaxyclientservice_privesc
Maturity: weaponized
Weaknesses
CWE · root cause- CWE-264Permissions, Privileges, and Access ControlsWeaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
- CWE-798Use of Hard-coded CredentialsThe product contains hard-coded credentials, such as a password or cryptographic key.
Affected systems
Gog2 products
- galaxy≥ 1.2.0, ≤ 1.2.64 | ≥ 2.0.0, ≤ 2.0.12
- gog galaxyclientservice2.0.12 | 1.2.64
1 vendor · 2 products
References
2 links- www.positronsecurity.com/blog/2020-04-28-gog-galaxy-client-local-privilege-escalation/X Refsource MISCExploitThird Party Advisory