CVE-2021-33526CWE-269

Privilege escalation in mbDIALUP <= 3.9R0.0

High · published August 2, 2021

CVSS v3.1
7.8
EPSS
0%
Percentile
15.9
In the wild
Unconfirmed
What it is

In MB connect line mbDIALUP versions <= 3.9R0.0 a low privileged local attacker can send a command to the service running with NT AUTHORITY\SYSTEM instructing it to execute a malicous OpenVPN configuration resulting in arbitrary code execution with the privileges of the service.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00253 · 15.9th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2021-08-02T10:24Z
EPSS history
Timeline
  • 02 AUG 10:24Z
    Privilege escalation in mbDIALUP <= 3.9R0.0
    cvelistv5