Sophos Intercept X Updater LPE: Dissecting CVE-2024-13972’s Registry Permission Flaw
Introduction
A single misconfigured registry key can turn a trusted endpoint security product into a launchpad for full system compromise. That is the real-world impact of CVE-2024-13972, a critical local privilege escalation (LPE) flaw in Sophos Intercept X for Windows, disclosed in July 2025. In enterprise and education environments where unprivileged users share workstations, an attacker could use it to seize SYSTEM-level control during a routine product upgrade and bypass the very protections meant to defend the endpoint.
About Sophos and Intercept X
Sophos is a major global cybersecurity vendor, with millions of endpoints protected worldwide and a strong presence in both enterprise and SMB markets. Intercept X for Windows is its flagship endpoint protection product, widely deployed for its exploit prevention and ransomware mitigation. Organizations across critical sectors trust the product, and that trust depends on its update mechanism being secure.
Technical Information
CVE-2024-13972 comes from how the Intercept X for Windows updater handled Windows registry permissions before version 2024.3.2. During product upgrades, the updater created or modified certain registry keys with access control lists (ACLs) that were too permissive. These ACLs let standard (non-administrative) local users modify registry values or subkeys that influence the upgrade process.
That misconfiguration gave local attackers a path to escalate privileges:
- An attacker with local access could identify the vulnerable registry keys that the updater creates or modifies during an upgrade.
- By altering those keys, for example by redirecting a path or injecting malicious data, the attacker could influence the behavior of the updater, which runs with SYSTEM privileges.
- On the next upgrade, the updater would process the attacker's changes and execute code or commands with full system rights.
The attack resembles earlier Windows LPE vulnerabilities in which registry misconfigurations let non-admins hijack privileged processes (8). Here, the flaw is specific to the Intercept X for Windows updater's handling of registry ACLs during upgrades. Exploiting it does not require administrative rights, only local access to the affected system (15, 9, 17).
Neither the vendor nor the researcher has published vulnerable code snippets or PoC details. The root cause is the updater's failure to restrict registry key modification to trusted accounts (such as SYSTEM or TrustedInstaller), which left a window for local users to tamper with upgrade-related configuration.
Patch Information
Sophos has fixed CVE-2024-13972, along with CVE-2025-7433 and CVE-2025-7472, in updates that harden registry permissions and correct the underlying flaw. The fixed versions are:
- Sophos Intercept X for Windows FTS 2025.2.3.9.2 and newer
- Sophos Intercept X for Windows LTS 2025.1.0.45 and newer
Customers using the default updating policy will receive these updates automatically. Customers on Fixed Term Support (FTS) or Long Term Support (LTS) packages must upgrade to these versions manually to be protected (15).
Detection Methods
Sophos Intercept X for Windows has several mechanisms to detect and mitigate local privilege escalation attempts, including attempts that exploit registry misconfigurations:
- Defenders can filter Application Event Logs by Event ID 911 to spot suspicious activity related to exploit prevention (community.sophos.com).
- Exploit prevention signatures identify and block known LPE techniques.
- Behavioral analysis watches for unusual process and registry activity that may indicate exploitation attempts.
- Keeping Sophos Intercept X up to date ensures the latest detection and prevention capabilities are in place (sophos.com).
Affected Systems and Versions
The vulnerability affects Sophos Intercept X for Windows in the following configurations:
- All versions prior to FTS 2025.2.3.9.2
- All versions prior to LTS 2025.1.0.45
Systems running these versions are at risk, especially in environments where local users have access but lack administrative rights. The flaw is present during the product upgrade process, so upgrade windows are particularly sensitive.
Vendor Security History
Sophos has a mature vulnerability disclosure and patch process, with a track record of timely advisories and coordinated releases. Registry permission issues have still surfaced in earlier advisories, such as CVE-2024-8885 and others affecting updater and configuration components (7, 15). The recurrence of LPE vulnerabilities tied to registry handling suggests this area needs ongoing architectural work. The vendor's transparency and its acknowledgment of researchers point to a strong security culture.
References
- NVD Entry for CVE-2024-13972
- Sophos Security Advisory: sophos-sa-20250717-cix-lpe
- SecAlerts: CVE-2024-13972
- Sophos Exploit Prevention Event Types
- Sophos Advisory: sophos-sa-20241002-cde-lpe
Source: This report was created using AI
If you have suggestions for improvement or feedback, please contact us at [email protected]
