Later archive addition

Logitech Options: an unauthenticated WebSocket server reachable from websites

taviso

Logitech Options starts a local WebSocket service that accepted connections from arbitrary web origins and performed little type validation. A malicious site could brute-force its weak process-ID check, crash handlers, reconfigure attached devices, and send keystrokes through the privileged desktop application.

Record

Researcher

taviso

In the archive

• Added to the 2018 archive after the original list was published

Tags

• websocket
• localhost
• origin-validation
• desktop-app
• rce

This page is the archive's own catalogue record. The research is the work of taviso, first published at the original source. Preserved copies are kept so the citation survives its host.