CVE-2024-0833 is a high severity (CVSS 7.8) privilege elevation in the installer of Telerik Test Studio versions before v2023.3.1330. A lower privileged user on a machine with an existing install can manipulate the installation package. Upgrade to v2023.3.1330 or later.
What's affected
Telerik Test Studio versions prior to v2023.3.1330. The record says a lower privileged user, where an install already exists, can manipulate the installation package to gain higher privileges on the operating system.
The record lists CWE-269 and CWE-276, so incorrect default permissions are part of the picture. The vendor product notice is called legacy installer vulnerability.
The record classifies the weakness as CWE-269 (improper privilege management) and CWE-276 (incorrect default permissions). NVD scores it 7.8 (High) with the vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H.
How to check if you're exposed
Find the installed product version through the product's own About dialog or the installed programs list on the machine. Then compare it with the fixed version named above.
The weakness here sits in the installer, so also check where old installer packages are stored, such as shared drives, build servers and software distribution points. An outdated installer on a share can be reused long after the product itself is updated.
What to do now
- List machines running Test Studio, including shared QA machines.
- Upgrade to v2023.3.1330 or later and follow the vendor notice.
- Remove old installer packages from shared locations.
- Check permissions on the installation directory and fix any write access for standard users.
Why it matters
The two weaknesses, improper privilege management and incorrect default permissions, combine into a familiar pattern: a privileged installer reads files a normal user can alter.
QA machines are often shared and rarely audited, which makes them an easy path to administrator rights on a network.
Two habits help with issues of this kind. First, keep a current inventory that records which machines run the product and which version, so a new advisory becomes a quick query instead of a hunt. Second, write down the owner of each system. Many fixes slip because nobody was sure who could approve the downtime. The free in-browser dependency scan at the scan page covers the application dependencies in your repositories, and the Gold directory lists known vulnerabilities by CVE, so you can see related entries for the same product.
The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing in the record says it is exploited in the wild. That can change, so keep it on your watch list.
Quick check
Why is this reachable only locally?
The attacker must already be on the machine as a standard user, which is why the score is high rather than critical.
Sources
The links below are the references listed in the CVE record. The record and its description were the basis for this post, and the vendor advisory remains the authority for fixed versions.
Last reviewed: 19 October 2026.
