It doesn’t necessarily stop here, however. RazerInstaller.exe running with SYSTEM privileges. Below is a version of the video that’s clearer than the one initially shared on Twitter: When j0nh4t initially didn’t hear back from Razer, the researcher posted a video that shows how the bug works.

At that point, you can right-click the installation window and press the Shift key, which opens a PowerShell terminal with those same elevated privileges. jonhat found that if a user opts to change the default location of the installation folder, it triggers a “Choose a folder” dialog.

Since the RazerInstaller.exe executable was launched via a Windows process running with SYSTEM privileges, the Razer installation program inherited those same Admin privileges. In other words, the setup routine for Synapse runs with the highest available privileges in Windows 10. SYSTEM privileges are the highest user privilege level in Windows: With a SYSTEM account, someone can get full control over the system, meaning that they can view, change or delete data can create new accounts with full user rights and can install whatever they want – including malware. The plug-and-play Razer Synapse installation then allows users to gain SYSTEM privileges on the Windows device lickety-split, since, as part of the setup routine, it opens an Explorer window that prompts the user to specify where the driver should be installed. So here's a freebie /xDkl87RCmzĪs the researcher tells it and has BleepingComputer confirmed in its own tests, the problem is that when a user plugs in a Razer device (or dongle, if it’s a wireless peripheral), Windows automatically fetches an installer containing driver software and the Synapse utility. – Abuse elevated Explorer to open Powershell with Shift+Right click – Windows Update will download and execute RazerInstaller as SYSTEM Need local admin and have physical access?

It also awarded jonhat a bug bounty, in spite of the fact that the bug was disclosed. As of Sunday, the tweet had caught Razer’s attention, and the manufacturer told jonhat that its security team was working on getting out a fix ASAP. The bug was reported by security researcher jonhat ( who tweeted about it on Saturday after initially not hearing back from Razer. Its Razer Synapse software enables users to configure hardware devices, set up macros or map buttons. Razer manufactures popular, high-end hardware for gamers, including mouses, keyboards and gaming chairs. There’s apparently nothing keeping the vulnerability from allowing the same privilege escalation on Windows 11, although, if that operating system has in fact been tested, its vulnerability hasn’t yet been reported. A zero-day bug in the device installer software for Razer peripherals – be they a Razer mouse, keyboard or any device that uses the Synapse utility – gives the plugger-inner full admin rights on Windows 10, just by inserting a compatible peripheral and downloading Synapse.

Razer mouse driver for win 10