Vulnerability Details : CVE-2021-34998
This vulnerability allows local attackers to escalate privileges on affected installations of Panda Security Free Antivirus 20.2.0.0. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the use of named pipes. The issue results from allowing an untrusted process to impersonate the client of a pipe. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-14208.
Vulnerability category: Execute code
Products affected by CVE-2021-34998
- cpe:2.3:a:watchguard:panda_antivirus:*:*:*:*:free:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2021-34998
0.05%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 12 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-34998
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.2
|
HIGH | AV:L/AC:L/Au:N/C:C/I:C/A:C |
3.9
|
10.0
|
NIST | |
|
7.0
|
HIGH | CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
1.0
|
5.9
|
Zero Day Initiative | |
|
7.8
|
HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
NIST |
CWE ids for CVE-2021-34998
-
The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.Assigned by: zdi-disclosures@trendmicro.com (Secondary)
-
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.Assigned by: nvd@nist.gov (Primary)
References for CVE-2021-34998
-
https://www.zerodayinitiative.com/advisories/ZDI-21-1336/
ZDI-21-1336 | Zero Day InitiativeThird Party Advisory;VDB Entry
-
https://www.pandasecurity.com/en/support/card?id=100077
Panda Security Free Antivirus Unnecessary Privileges Local Privilege Escalation Vulnerability - Technical Support - Panda SecurityVendor Advisory
Jump to