MSI Center – How to gain SYSTEM privileges in seconds

huflungdung

You have physical access to the machine. Dump its bios and inject this https://download.microsoft.com/download/8/a/2/8a2fb72d-9b96-... Shrug.emoji

Klathmon

Is there any valid reason to still be using 3DES in 2026? It was formally deprecated in 2018 and has been surpassed in just about every single way by AES long before that. At this point I feel like it's use is such a huge red flag

nzeid

> After this minor hiccup, the experience with MSI was actually quite pleasant. They prepared a patch for the vulnerability within two days of me reporting it and told me which MSI Center release it was to be bundled with, and when they planned to release the new version. Was NOT expecting a happy ending. I don't know if the part of MSI Center with the pipe vulnerability is automatically installed on desktops but this is the terribly written software that you need to turn off all the obnoxious lights on your MB and DRAM.

drdexebtjl

I wish the author went into a bit more detail about how MSI fixed it, as is usual in write ups like this. It left me thinking maybe the patch introduced a different vulnerability that’s still under an embargo :)

aucisson_masque

> So far, for the vulnerabilities I have reported to Google, ASUS, AMD, TP-Link, Netgear, MSI (and more), they have paid out a total of $0 in bug bounties. Why bother reporting to them ? You could just as well sell it to third parties if it doesn't interest them.