CVE-2024-4454 is a High (CVSS 7.8 in NVD, 7.3 in ZDI) local privilege escalation in the WithSecure plugin hosting service, reached by creating a symbolic link. Code can run as SYSTEM. ZDI says WithSecure issued an update. Apply it, and check the WithSecure advisory for fixed versions.
What's affected
- Product: WithSecure Elements Endpoint Protection on Windows. The record's CPE entries also list Client Security 15 and Email and Server Security 15.
- Affected component: the WithSecure plugin hosting service.
- Fixed version: ZDI says WithSecure issued an update and points to the vendor advisory at withsecure.com for cve-2024-4454. I did not fetch that advisory, so I do not state a version number.
- Severity conflict: NVD scores 7.8 and ZDI scores 7.3. Both are High. Both say local access and user interaction by an administrator.
- ZDI timeline: reported 2024-02-23, published 2024-05-22, updated 2024-07-01.
- Exploitation: KEV is false.
How to check if you're exposed
In the WithSecure management console, check the product version on each endpoint and compare with the fixed version in the vendor advisory. Also check whether automatic updates are enabled for the product, since many installations update on their own.
The attacker already needs a local foothold, so combine this with a review of who has local accounts on your shared and server systems.
What to do now
- Open the WithSecure advisory for CVE-2024-4454 and note the fixed version for each product line.
- Verify installed versions across endpoints and servers, and force the update where missing.
- Confirm automatic updates are on.
- Reduce standing local accounts on shared systems, particularly terminal servers.
- Monitor for unusual file creation by the plugin hosting service.
Why it matters
The record maps this to CWE-59, improper link resolution before file access. A privileged service writes a file at a path, and the attacker has swapped part of that path for a symbolic link so the service writes somewhere else. Because the service runs as SYSTEM, the result can be attacker chosen content in a protected location.
Security software runs with high privileges and so is a valuable target. Flaws in it give a small edge to an attacker who is already on the machine, which makes timely updates of endpoint agents as important as updates of the operating system.
Quick check
Why do NVD and ZDI show different scores?
NVD lists 7.8 and ZDI lists 7.3 for the same issue. They rate some metrics differently. Both are High.
Does an attacker need local access?
Yes. The vector is local, and ZDI says an administrator must take an action.
Scan your own dependencies
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks a manifest against known advisories, and the Gold directory keeps this record's details in one place.
Sources
The NVD record for CVE-2024-4454 (published 2024-05-22) supplied the description, score and weakness data. Pages marked fetched were read for this post. The others are listed in the record and were not read.
Last reviewed: 19 October 2026.
