CVE-2020-12828 Command injection in n/a
A local attacker can execute arbitrary code with SYSTEM privileges by binding to a localhost socket and providing a malicious executable path in the AnchorFree VPN SDK.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-12828?
CVE-2020-12828 is a critical command injection vulnerability in n/a, published on 21 May 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in AnchorFree VPN SDK before 1.3.3.218. The VPN SDK service takes certain executable locations over a socket bound to localhost. Binding to the socket and providing a path where a malicious executable file resides leads to executing the malicious executable file with SYSTEM privileges.
Weakness: CWE-434
Which versions are affected by CVE-2020-12828?
It affects 1 product.
Products include Pango Virtual Private Network Software Development Kit.
How do I fix CVE-2020-12828?
No fix has been published for CVE-2020-12828 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2020-12828 being exploited?
There is no known exploitation of CVE-2020-12828 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-g55c-xmw4-5crg.