CVE-2021-35064

KramerAV VIAWare, all tested versions, allow privilege escalation through misconfiguration of sudo

published July 12, 2021

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.4th percentile for exploit probability.

CVSS
—
EPSS
71%
Percentile
99.4
In the wild
Unconfirmed
What it is

⚠️ A misconfigured sudoers file opens the door for privilege escalation in KramerAV VIAWare! All tested versions are affected, making this a surprisingly sneaky oversight. 😱 Imagine a restaurant where the chef can not only cook but also decide the menu and change the locks — that’s what this sudo misconfiguration allows! It’s like giving someone the master key without checking their credentials first. An attacker could exploit this misconfiguration to execute dangerous commands, potentially taking full control of the system. They could run critical commands like 'systemctl' or 'dpkg', effectively turning a simple user into a system administrator. The risks associated with this escalation are alarming!

Put simply

Imagine a restaurant where the chef can not only cook but also decide the menu and change the locks — that’s what this sudo misconfiguration allows! It’s like giving someone the master key without checking their credentials first. This vulnerability allows users to run high-privilege commands through a misconfigured sudoers file, enabling actions that could compromise system integrity and security.

What to do

An attacker could exploit this misconfiguration to execute dangerous commands, potentially taking full control of the system. They could run critical commands like 'systemctl' or 'dpkg', effectively turning a simple user into a system administrator. The risks associated with this escalation are alarming! Ensure that your sudoers configuration is audited and modified to restrict unnecessary command access. Review user permissions and update your system to ensure that only trusted users can run commands like unzip, systemctl, and dpkg. Patch your installation if necessary! Fixing this misconfiguration is totally doable! Follow these steps to bolster your system's defenses and secure your environment. 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.70753 · 99.4th percentile
Published
2021-07-12T11:09Z
EPSS history
Timeline
  • 12 JUL 11:09Z
    KramerAV VIAWare, all tested versions, allow privilege escalation through misconfiguration of sudo
    cvelistv5