CVE-2024-0197 is a high severity (CVSS 7.8) flaw in the installer for Thales SafeNet Sentinel HASP LDK on Windows. With local access, an attacker can escalate their privilege level. The record lists versions before 9.16 as affected, so upgrade to 9.16 or later and check the Thales advisory.
What's affected
The NVD description says Thales SafeNet Sentinel HASP LDK versions prior to 9.16 on Windows are affected. The fix is version 9.16 or later.
The only reference in the record is the Thales support portal, which needs a login, so we could not read the advisory itself. Check it for installer details, affected packages and any workaround. Sentinel HASP is licensing and copy protection software that vendors bundle with their own products, so you may have it without having chosen it.
How to check if you're exposed
Look for Sentinel or HASP components on Windows machines. Check installed programs for names such as Sentinel HASP Run-time or Sentinel LDK, and look for the HASP driver in the device list. Your endpoint inventory can list installed software and versions.
Because software vendors embed the runtime, also ask suppliers of engineering, CAD and industrial software which Sentinel version they ship. The installer is the vulnerable part, so updated vendor packages matter.
What to do now
- Search your Windows fleet for Sentinel HASP or Sentinel LDK components and their versions.
- Ask software vendors that bundle it whether their installers use version 9.16 or later.
- Open the Thales advisory through the support portal and follow it.
- Limit who can run installers on shared or sensitive machines.
Why it matters
The record classes this as CWE-269, improper privilege management. A privileged installer can be pushed into doing something for a lower privileged user. Installers often run as SYSTEM, which makes them a common source of local privilege escalation.
The vector is local, low complexity, low privileges, with no user interaction. Thales gives no more detail in the record, and we do not guess at the mechanism. The record does not show exploitation in the wild. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan, and the Gold directory lists the CVE and CWE pages used here.
Quick check
Is this remotely exploitable?
The record says local access is needed.
Where do I find the advisory?
The record points to the Thales support portal, which requires an account.
Sources
Last reviewed: 19 October 2026.
