Skip to content

Instantly share code, notes, and snippets.

Unsafe usage of .NET deserialization in Named Pipe message processing allows privilege escalation to NT AUTHORITY\SYSTEM for a local attacker. Affected product is TinyWall, all version up to and including 2.1.12. Fixed in version 2.1.13.