CVE-2024-9766

Executive Summary

CVE-2024-9766 is a local privilege escalation vulnerability in Wacom Center’s WTabletServicePro service. The flaw allows an attacker with low-privileged code execution on the target system to create a symbolic link, abusing the service to write a file in a privileged context. Successful exploitation leads to arbitrary code execution as SYSTEM. The vulnerability has a CVSS score of 7.8 (High) and is currently unpatched. No public proof-of-concept or exploit code has been released, but the risk is significant for enterprise environments using Wacom tablets.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a native Windows service vulnerability in Wacom Center software.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.8 (High)
• Attack Vector: Local (AV:L) – requires local access to the system.
• Attack Complexity: Low (AC:L) – no special conditions needed.
• Privileges Required: Low (PR:L) – attacker needs initial low-privileged code execution.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – exploitation stays within the same security authority.
• Confidentiality, Integrity, Availability Impact: High (C:H/I:H/A:H) – full compromise of the system.

Deep Dive & Mechanics

The vulnerability resides in the WTabletServicePro process, part of Wacom Center. This service runs with SYSTEM privileges. The flaw is a classic "Link Following" vulnerability (CWE-59: Improper Link Resolution Before File Access). An attacker with low-privileged code execution can create a symbolic link (symlink) pointing from a location the service writes to, to a critical system file (e.g., a DLL or executable). When the service writes to that location, it follows the symlink and overwrites the target file. This allows the attacker to replace a legitimate system file with a malicious one, which is then executed with SYSTEM privileges.

The attack chain:

1. Attacker gains low-privileged code execution (e.g., via malware or user compromise).
2. Attacker identifies a writable directory used by WTabletServicePro.
3. Attacker creates a symlink from that directory to a target file (e.g., C:\Windows\System32\evil.dll).
4. The service writes to the directory, following the symlink and overwriting the target.
5. The malicious file is executed in the context of SYSTEM, granting full control.

Vulnerable vs. Patched Code

No patched version is available. The vulnerable code likely involves a file write operation without proper symlink checks. A patched version would:

• Use CreateFile with FILE_FLAG_OPEN_REPARSE_POINT to avoid following symlinks.
• Validate the target path is within an expected directory.
• Use impersonation or lower privileges for file operations.

Example vulnerable pseudo-code:

// Vulnerable: writes to user-controlled path without symlink check
HANDLE hFile = CreateFile(userPath, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, 0, NULL);
WriteFile(hFile, data, size, &written, NULL);
CloseHandle(hFile);

Patched pseudo-code:

// Patched: uses FILE_FLAG_OPEN_REPARSE_POINT to avoid symlink
HANDLE hFile = CreateFile(userPath, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, FILE_FLAG_OPEN_REPARSE_POINT, NULL);
if (GetFileAttributes(userPath) & FILE_ATTRIBUTE_REPARSE_POINT) {
    // Handle symlink case
    CloseHandle(hFile);
    return ERROR;
}
WriteFile(hFile, data, size, &written, NULL);
CloseHandle(hFile);

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Local low-privileged access to a Windows system with Wacom Center installed.
• Knowledge of the writable directory used by WTabletServicePro (e.g., C:\ProgramData\Wacom\).

Steps:

1. Identify the writable directory: C:\ProgramData\Wacom\.
2. Create a malicious DLL (e.g., evil.dll) that executes a reverse shell or adds a user.
3. Create a symlink from the writable directory to a system DLL (e.g., C:\Windows\System32\evil.dll):

   mklink "C:\ProgramData\Wacom\evil.dll" "C:\Windows\System32\evil.dll"
   

4. Trigger the service to write to that path (e.g., by restarting the service or performing a specific action).
5. The service writes the malicious DLL to the system directory.
6. Execute the DLL (e.g., via rundll32 or by triggering a service that loads it).

Note: No public exploit exists; this is a theoretical attack path.

Blue Team (Defense & Detection)

Detection:

• Monitor for symlink creation events (Event ID 4663 with access mask 0x2).
• Monitor file writes to C:\ProgramData\Wacom\ and other Wacom directories.
• Use Sysmon to log process creation and file creation events.

Prevention:

• Restrict write permissions to Wacom directories to only SYSTEM and Administrators.
• Enable Windows Defender Exploit Guard to block symbolic link creation from low-integrity processes.
• Apply the principle of least privilege to the Wacom service.

Indicators of Compromise (IOCs)

• File Paths:
  • C:\ProgramData\Wacom\*.dll (unexpected DLLs)
  • C:\Windows\System32\evil.dll (malicious DLL)
• Processes:
  • WTabletServicePro.exe (abnormal file operations)
• Registry:
  • HKLM\SYSTEM\CurrentControlSet\Services\WTabletServicePro (modified service path)
• Network:
  • Outbound connections from WTabletServicePro.exe to unknown IPs (if DLL is a reverse shell)

Detection Engineering

YARA Rule

rule CVE_2024_9766_Wacom_Symlink {
    meta:
        description = "Detects potential exploitation of CVE-2024-9766 via symlink creation"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-9766"
    strings:
        $s1 = "WTabletServicePro" nocase
        $s2 = "CreateSymbolicLink" nocase
        $s3 = "\\ProgramData\\Wacom\\" nocase
    condition:
        $s1 and ($s2 or $s3)
}

Sigma Rule

title: CVE-2024-9766 Wacom Symlink Exploitation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects symlink creation targeting Wacom directories
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    service: security
    category: file_event
detection:
    selection:
        EventID: 4663
        ObjectName|contains: '\\ProgramData\\Wacom\\'
        AccessMask: '0x2'  # Write access
    condition: selection
falsepositives:
    - Legitimate Wacom updates
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-9766 Wacom Potential Reverse Shell"; flow:to_server,established; content:"|00 00 00 00|"; depth:4; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Wacom Service Permissions: Ensure only SYSTEM and Administrators can write to C:\ProgramData\Wacom\ and related directories.
2. Disable Wacom Center Service: If not needed, stop and disable WTabletServicePro via services.msc.
3. Apply Windows Defender Exploit Guard: Enable rules to block symbolic link creation from low-integrity processes.
4. Monitor for Suspicious Activity: Use the provided YARA and Sigma rules to detect exploitation attempts.

Long-Term Fix:

• Await an official patch from Wacom. Until then, consider removing Wacom Center from critical systems or using alternative input devices.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.