---
id: CVE-2022-24139
title: >-
  In IOBit Advanced System Care (AscService.exe) 15, an attacker with
  SEImpersonatePrivilege can create a named pipe with the same name as one of
  ASCService's named pipes
summary: >-
  In IOBit Advanced System Care (AscService.exe) 15, an attacker with
  SEImpersonatePrivilege can create a named pipe with the same name as one of
  ASCService's named pipes. ASCService first tries to connect before trying to
  create the named…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-668
vendor: iobit
product: advanced_system_care
affected:
  - advanced_system_care = 15
published: '2022-07-06'
updated: '2026-07-05'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2022-24139'
references:
  - url: 'https://github.com/tomerpeled92/CVE/'
    label: cve@mitre.org
  - url: 'http://advanced.com'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://iobit.com'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://github.com/tomerpeled92/CVE/'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.0037
epssPercentile: 0.2822
ingestedAt: '2026-07-06T17:03:24.826Z'
---

## Overview

In IOBit Advanced System Care (AscService.exe) 15, an attacker with SEImpersonatePrivilege can create a named pipe with the same name as one of ASCService's named pipes. ASCService first tries to connect before trying to create the named pipes, because of that during login the service will try to connect to the attacker which will lead to either escalation of privileges (through token manipulation and ImpersonateNamedPipeClient() ) from ADMIN -> SYSTEM or from Local ADMIN-> Domain ADMIN depending on the user and named pipe that is used.

## Affected

- `advanced_system_care = 15`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.