<?xml version="1.0" encoding="UTF-8"?>
<?xml-stylesheet type="text/xsl" href="rss.xsl"?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
  <channel>
    <title>Logitech — recent CVEs</title>
    <link>https://vulnogram.org/</link>
    <atom:link href="https://vulnogram.org/rss/logitech" rel="self" type="application/rss+xml"/>
    <description>Most recent CVEs assigned by Logitech (logitech).</description>
    <image>
      <url>https://vulnogram.org/seaview/icons/logitech.png</url>
      <title>Logitech — recent CVEs</title>
      <link>https://vulnogram.org/</link>
    </image>
    <lastBuildDate>Wed, 21 Oct 2026 07:00:07 GMT</lastBuildDate>
    <item>
      <title>CVE-2026-12518 · 8.5 HIGH — Local privilege escalation in the Logi Options+ updater service on Windows</title>
      <link>https://vulnogram.org/CVE-2026-12518</link>
      <guid isPermaLink="true">https://vulnogram.org/CVE-2026-12518</guid>
      <description>A local privilege escalation vulnerability in the Logitech Logi Options+ updater service on Windows allows a low-privileged local user to execute arbitrary code as SYSTEM.</description>
      <category>High</category>
      <pubDate>Mon, 14 Sep 2026 07:27:36 GMT</pubDate>
    </item>
    <item>
      <title>CVE-2024-8258 · 2 LOW — Insecure Electron Fuses in Logitech Options Plus Allowing Arbitrary Code Execution on macOS</title>
      <link>https://vulnogram.org/CVE-2024-8258</link>
      <guid isPermaLink="true">https://vulnogram.org/CVE-2024-8258</guid>
      <description>Improper Control of Generation of Code (&apos;Code Injection&apos;) in Electron Fuses in Logitech Options Plus version 1.60.496306 on macOS allows attackers to execute arbitrary code via insecure Electron Fuses configuration.</description>
      <category>Low</category>
      <pubDate>Tue, 10 Sep 2024 08:36:34 GMT</pubDate>
    </item>
    <item>
      <title>CVE-2024-8011 · 2 LOW</title>
      <link>https://vulnogram.org/CVE-2024-8011</link>
      <guid isPermaLink="true">https://vulnogram.org/CVE-2024-8011</guid>
      <description>Logitech Options+ on MacOS prior 1.72 allows a local attacker to inject dynamic library within Options+ runtime and abuse permissions granted by the user to Options+ such as Camera.</description>
      <category>Low</category>
      <pubDate>Sun, 25 Aug 2024 11:44:45 GMT</pubDate>
    </item>
    <item>
      <title>CVE-2024-4031 · 4.4 MEDIUM — MEVO WEBCAM APP Windows Unquoted Service Path Vulnerability</title>
      <link>https://vulnogram.org/CVE-2024-4031</link>
      <guid isPermaLink="true">https://vulnogram.org/CVE-2024-4031</guid>
      <description>Unquoted Search Path or Element vulnerability in Logitech MEVO WEBCAM APP on Windows allows Local Execution of Code.</description>
      <category>Medium</category>
      <pubDate>Tue, 23 Apr 2024 06:29:58 GMT</pubDate>
    </item>
    <item>
      <title>CVE-2024-2537 · 4.4 MEDIUM — Electron Code Injection in Logi Tune macOS Application</title>
      <link>https://vulnogram.org/CVE-2024-2537</link>
      <guid isPermaLink="true">https://vulnogram.org/CVE-2024-2537</guid>
      <description>Improper Control of Dynamically-Managed Code Resources vulnerability in Logitech Logi Tune on MacOS allows Local Code Inclusion.</description>
      <category>Medium</category>
      <pubDate>Fri, 15 Mar 2024 17:12:10 GMT</pubDate>
    </item>
    <item>
      <title>CVE-2022-0916 · 8.4 HIGH — Broken authentication on Logitech Options due to misvalidation of Oauth state parameter</title>
      <link>https://vulnogram.org/CVE-2022-0916</link>
      <guid isPermaLink="true">https://vulnogram.org/CVE-2022-0916</guid>
      <description>An issue was discovered in Logitech Options. The OAuth 2.0 state parameter was not properly validated. This leaves applications vulnerable to CSRF attacks during authentication and authorization operations.</description>
      <category>High</category>
      <pubDate>Tue, 03 May 2022 13:40:09 GMT</pubDate>
    </item>
    <item>
      <title>CVE-2022-0915 · 6 MEDIUM — Logitech Sync desktop application prior to 2.4.574 - TOCTOU during installation leads to privelege escalation</title>
      <link>https://vulnogram.org/CVE-2022-0915</link>
      <guid isPermaLink="true">https://vulnogram.org/CVE-2022-0915</guid>
      <description>There is a Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability in Logitech Sync for Windows prior to 2.4.574. Successful exploitation of these vulnerabilities may escalate the permission to the system user.</description>
      <category>Medium</category>
      <pubDate>Tue, 12 Apr 2022 18:35:09 GMT</pubDate>
    </item>
  </channel>
</rss>
