CVE-2021-31841CWE-347CWE-426

DLL side loading vulnerability in MA for Windows

High · published September 22, 2021

CVSS v3.1
8.2
EPSS
0%
Percentile
14.4
In the wild
Unconfirmed
What it is

A DLL sideloading vulnerability in McAfee Agent for Windows prior to 5.7.4 could allow a local user to perform a DLL sideloading attack with an unsigned DLL with a specific name and in a specific location. This would result in the user gaining elevated permissions and the ability to execute arbitrary code as the system user, through not checking the DLL signature.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00241 · 14.4th percentile
Weaknesses
CWE-347 · Improper Verification of Cryptographic Signature; CWE-426 · Untrusted Search Path
Published
2021-09-22T13:25Z
EPSS history
Timeline
  • 22 SEP 13:25Z
    DLL side loading vulnerability in MA for Windows
    cvelistv5