Vulnerability Details : CVE-2015-4173
Unquoted Windows search path vulnerability in the autorun value in Dell SonicWall NetExtender before 7.5.227 and 8.0.x before 8.0.238, as used in the SRA firmware before 7.5.1.2-40sv and 8.x before 8.0.0.3-23sv, allows local users to gain privileges via a Trojan horse program in the %SYSTEMDRIVE% folder.
Products affected by CVE-2015-4173
- cpe:2.3:a:sonicwall:netextender:*:*:*:*:*:windows:*:*
- cpe:2.3:a:sonicwall:netextender:*:*:*:*:*:windows:*:*
Exploit prediction scoring system (EPSS) score for CVE-2015-4173
0.04%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 6 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2015-4173
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.9
|
MEDIUM | AV:L/AC:M/Au:N/C:C/I:C/A:C |
3.4
|
10.0
|
NIST |
CWE ids for CVE-2015-4173
-
The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-4173
-
http://www.securityfocus.com/archive/1/536303/100/0/threaded
SecurityFocusThird Party Advisory;VDB Entry
-
http://www.securitytracker.com/id/1033417
Dell SonicWALL Extender Unquoted Search Path Lets Local Users Gain Elevated Privileges - SecurityTrackerThird Party Advisory;VDB Entry
-
http://packetstormsecurity.com/files/133302/Dell-SonicWall-NetExtender-7.5.215-Privilege-Escalation.html
Dell SonicWall NetExtender 7.5.215 Privilege Escalation ≈ Packet StormThird Party Advisory;VDB Entry
-
https://support.software.dell.com/product-notification/157537
Broken Link
Jump to