CVE-2023-3513

Executive Summary

CVE-2023-3513 is a privilege escalation vulnerability in Razer's RazerCentral application (versions up to and including 7.11.0.558) on Windows, stemming from an unsafe .NET deserialization flaw accessible through the RazerCentralService named pipe. A low-privilege local user can exploit this flaw to achieve full SYSTEM-level privileges on the host machine. The vulnerability carries a CVSS score of 7.8 (High) and is currently unpatched, with no known public exploit code or evidence of in-the-wild exploitation.

Technical Analysis

The vulnerability resides in an improper privilege control mechanism within the RazerCentralService named pipe component of RazerCentral, an application management and peripheral configuration tool used by Razer hardware owners. The NVD description explicitly states that the flaw is triggered via a named pipe communication channel that is accessible to low-privilege users.

At the vulnerability-class level, this is an unsafe .NET deserialization issue — a well-known class of attack where an application deserializes attacker-controlled data without proper validation or type restriction. In this specific case, the named pipe interface of RazerCentralService fails to enforce sufficient privilege checks, allowing a low-privileged local attacker to send serialized .NET objects that, when deserialized by the service (running with SYSTEM privileges), execute arbitrary code in the security context of the service.

The attack surface is purely local — no network exposure is implied. The named pipe (a Windows inter-process communication (IPC) mechanism) is the entry point. "Improper Privilege Control" indicates the service does not adequately verify the identity or integrity of the pipe client, permitting unprivileged users to access sensitive command/response functionality.

Key technical details from the description:

• Component: RazerCentralService (a background service)
• Mechanism: Named pipe IPC endpoint
• Flaw class: Unsafe .NET deserialization triggered via pipe messages
• Prerequisite: Local access as a low-privilege user
• Result: Code execution as SYSTEM

The EPSS score of 0.00343 (27.1% percentile) indicates this is not a widely exploited vulnerability as of the scoring date, but the CVSS vector (Local, Low complexity, Low privileges required, No user interaction) reflects a serious local threat where any standard user account can escalate to full administrative control.

Exploitation Scenarios

No public PoC is available for this vulnerability; the attack chain is inferred from the vulnerability class and the NVD description.

Step 1 — Reconnaissance and Target Identification: The attacker requires local access to a Windows host with RazerCentral version ≤ 7.11.0.558 installed. This could be achieved through initial compromise (e.g., phishing, malicious downloads, or physical access to the workstation). The attacker verifies the RazerCentralService process is running (e.g., via task manager or PowerShell Get-Process) and enumerates the named pipe endpoint using tools like WinObj or PowerShell ls \\.\pipe\.

Step 2 — Triggering the Flaw:

• The attacker connects to the RazerCentralService named pipe using standard Windows named pipe client APIs (e.g., CreateFile on \\.\pipe\... in C#/Python, or tools like impacket).
• Because the service does not properly enforce privilege checks on pipe clients, the low-privilege user's connection is accepted.
• The attacker crafts malicious .NET serialized payloads (e.g., using BinaryFormatter or Json.NET gadget chains) targeting known deserialization gadgets that allow code execution — common targets include System.Windows.Data.ObjectDataProvider or System.Configuration.Install.AssemblyInstaller.

Step 3 — Payload Execution: The malicious serialized object is sent over the named pipe. When the RazerCentralService deserializes the payload (running as SYSTEM), the gadget chain executes, running arbitrary code with SYSTEM privileges. This typically involves writing and executing a payload such as a reverse shell, a new administrative user account, or disabling security controls.

Step 4 — Post-Exploitation Impact: At SYSTEM level, the attacker gains full control over the compromised host. Privilege escalation enables:

• Disabling anti-virus/EDR products
• Extracting credentials and secrets from LSASS or registry hives
• Lateral movement within the enterprise network using the SYSTEM account
• Persistent access via service installation or scheduled tasks

Constraint: This is a local vulnerability; it does not allow remote exploitation without prior local access.

Impact Assessment

Confidentiality Impact (High): SYSTEM access allows reading all files, registry values, and memory contents across the entire system.

Integrity Impact (High): Full write access to the filesystem, registry, and ability to modify security settings.

Availability Impact (High): SYSTEM privileges allow disabling services, deleting critical files, or rendering the OS inoperable.

Affected Systems: All RazerCentral installations ≤ 7.11.0.558 on Windows — including Razer Blade laptops, desktop peripherals (mice, keyboards, headsets) bundled with RazerCentral, and enterprise BYOD environments where Razer hardware is used.

CVSS Breakdown (7.8):

• Attack Vector: Local (AV:L)
• Attack Complexity: Low (AC:L) — no special conditions beyond local access
• Privileges Required: Low (PR:L) — a standard user account suffices
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)

Blast Radius: Each compromised endpoint is fully controlled. In enterprise environments, a single endpoint with RazerCentral creates a full-domain-compromise risk if the SYSTEM account is subsequently used for lateral movement with cached credentials or pass-the-ticket attacks.

Detection Guidance

Sigma Rule

title: RazerCentralService Named Pipe Unsafe Deserialization Attempt
id: 8f3a22c9-5f3a-4b5c-9d3a-1a2b3c4d5e6f
status: experimental
description: Detects potential exploitation of CVE-2023-3513 via named pipe access to RazerCentralService
author: Valtersit Threat Intelligence
date: 2025/01/15
logsource:
    category: process_creation
    product: windows
detection:
    selection_pipe:
        Image|endswith: 'RazerCentralService.exe'
    selection_connection:
        # Generic detection of the named pipe used by RazerCentralService
        CommandLine|contains: 'RazerCentralService'
    condition: selection_pipe or selection_connection
    level: high
tags:
    - attack.privilege_escalation
    - attack.t1068
    - cve.2023.3513

YARA Rule

rule cve_2023_3513_razercentral_deserialization
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects .NET deserialization payloads commonly used against RazerCentralService"
        date = "2025-01-15"
        cve = "CVE-2023-3513"
    strings:
        $s1 = "BinaryFormatter" nocase
        $s2 = "ObjectDataProvider" nocase
        $s3 = "RazerCentralService" nocase
        $s4 = "AssemblyInstaller" nocase
        $s5 = "System.Windows.Data" nocase
    condition:
        any of ($s1, $s2, $s4, $s5) and $s3
}

Suricata IDS Rule

alert ip any any -> any any (msg:"CVE-2023-3513 Attempted RazerCentralService Deserialization Exploit"; content:"RazerCentralService"; nocase; content:"BinaryFormatter"; nocase; distance:0; flow:established; classtype:attempted-admin; sid:1003513; rev:1;)

Elastic Detection

// Detects execution of RazerCentralService with suspicious child processes or unusual named pipe access
process where event.type == "start" and process.executable : "*RazerCentralService*"
| follower process where process.name : ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe")

Splunk SPL Query

index=windows EventCode=4688
| where Image like "%RazerCentralService%"
| rex field=CommandLine "(?P<pipe_name>\\.\pipe\\.+?)"
| table _time, user, Image, CommandLine, pipe_name
| rename _time AS Time, user AS Account

Wazuh OSSEC Rule

<rule id="362039" level="12">
    <if_sid>5000000</if_sid>
    <match>RazerCentralService</match>
    <description>CVE-2023-3513: Detected access to RazerCentralService named pipe - potential unsafe deserialization attempt</description>
    <group>local_privilege_escalation,</group>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No vendor fix, official advisory, or patched version has been identified from any tracked source. The vendor has not released remediation guidance as of this report.

1. Immediate Mitigations

• Restrict Local Access: Limit standard user ability to interact with the RazerCentralService named pipe by modifying access control lists (ACLs) and removing write permissions for non-administrative users if feasible.
• Disable RazerCentralService: If Razer hardware does not critically require the central service, stop and disable the RazerCentralService Windows service. Peripheral functionality may degrade, but security takes precedence.
• Remove RazerCentral: Uninstall RazerCentral on assets that do not need Razer hardware management, especially on sensitive systems.
• Behavioral Monitoring: Deploy endpoint detection and response (EDR) rules to alert on named pipe enumeration and suspicious process creation spawned from the service.

2. Patch/Upgrade Steps

• Monitor vendor advisories: Track Razer's official security advisories and RazerCentral release notes for a patched version (expected to be > 7.11.0.558). Update immediately when released.
• Verify version: Check installed version via Control Panel > Programs and Features or Get-ItemProperty "HKLM:\Software\Razer\Installer".

3. Long-Term Hardening

• Principle of Least Privilege: Ensure standard users operate with minimal local rights; enforce AppLocker or WDAC policies to restrict execution of unknown binaries.
• Named Pipe Security: Apply best practices for service IPC — require authentication and privilege checks on all honored named pipe endpoints.
• Regular Audits: Include RazerCentral (and other third-party drivers/utilities) in routine vulnerability scanning and patch compliance checks.
• Network Segmentation: Treat endpoints running unpatched privilege-escalation vectors as a risk; restrict SMB, RDP, and lateral movement paths from those hosts.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2023-3513
2. CVE.org Record: https://www.cve.org/CVERecord?id=CVE-2023-3513
3. CISA KEV Catalog: Not listed (verified absence as of 2025-01-15)
4. Razer Central Product Page and Release Notes: https://www.razer.com/central (for patch monitoring)

Exploitation-in-the-Wild Evidence: None reported. CISA KEV does not list this CVE. No public exploit code, PoC, or threat actor campaign referencing CVE-2023-3513 has been identified. EPSS percentile (27.1%) suggests low current exploitation likelihood, but the unpatched status and high CVSS warrant proactive defensive attention.