Skip to main content

Vulnerability lets people gain admin rights on Windows 10 PCs by using Razer mice

Razer Viper
Razer Viper (Image credit: Windows Central)

What you need to know

  • A vulnerability was recently revealed that lets people gain SYSTEM access on a PC by plugging in a Razer mouse or dongle.
  • The vulnerability requires local access but could be used to install malicious software onto a PC.
  • Razer is now working on a fix for the issue.

A security researcher named Jon Hat recently revealed that you could gain SYSTEM access on a PC by plugging in a Razer gaming mouse or dongle (via Neowin). If you have local access to a machine, plugging in a Razer device installs RazerInstaller.exe, which runs with SYSTEM privileges. It also allows someone to open Windows PowerShell and the File Explorer with elevated privileges. With this exploit, someone could install harmful software onto a computer.

Because of the nature of the vulnerability, a person requires physical access to a PC to exploit it. This makes it less dangerous than a vulnerability that can be exploited remotely, but it still leaves a security risk.

See more

While separate, this Razer-related vulnerability has some characteristics in common with the PrintNightmare vulnerabilities on Windows 10. Both types of vulnerabilities rely on someone installing an item on a local account and gaining SYSTEM privileges despite not being an admin on a computer.

Hat explains that he reported the vulnerability to Razer but did not initially hear back from the company. Following this, Hat shared the vulnerability publicly. Since, Razer has responded to Hat, explaining that it is working on a fix.

See more

Razer offered Hat a bounty for finding the vulnerability, even though it was disclosed publicly.

Sean Endicott
Sean Endicott

Sean Endicott is the news writer for Windows Central. If it runs Windows, is made by Microsoft, or has anything to do with either, he's on it. Sean's been with Windows Central since 2017 and is also our resident app expert. If you have a news tip or an app to review, hit him up at sean.endicott@futurenet.com.