Описание
An issue was discovered in AnchorFree VPN SDK before 1.3.3.218. The VPN SDK service takes certain executable locations over a socket bound to localhost. Binding to the socket and providing a path where a malicious executable file resides leads to executing the malicious executable file with SYSTEM privileges.
Ссылки
- Vendor Advisory
- Vendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 1.3.3.218 (исключая)
cpe:2.3:a:pango:virtual_private_network_software_development_kit:*:*:*:*:*:*:*:*
EPSS
Процентиль: 94%
0.14757
Средний
9.8 Critical
CVSS3
10 Critical
CVSS2
Дефекты
CWE-434
Связанные уязвимости
github
больше 3 лет назад
An issue was discovered in AnchorFree VPN SDK before 1.3.3.218. The VPN SDK service takes certain executable locations over a socket bound to localhost. Binding to the socket and providing a path where a malicious executable file resides leads to executing the malicious executable file with SYSTEM privileges.
EPSS
Процентиль: 94%
0.14757
Средний
9.8 Critical
CVSS3
10 Critical
CVSS2
Дефекты
CWE-434