CVE-2020-5147 Privilege escalation in SonicWall NetExtender

What is CVE-2020-5147?

CVE-2020-5147 is a medium-severity vulnerability in SonicWall NetExtender, published on 9 Jan 2021. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

SonicWall NetExtender Windows client vulnerable to unquoted service path vulnerability, this allows a local attacker to gain elevated privileges in the host operating system. This vulnerability impact SonicWall NetExtender Windows client version 10.2.300 and earlier.

Weakness: CWE-428

Which versions are affected by CVE-2020-5147?

It affects 1 product.

Products include Sonicwall Netextender.

How do I fix CVE-2020-5147?

No fix has been published for CVE-2020-5147 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-5147 being exploited?

There is no known exploitation of CVE-2020-5147 in the wild and no public exploit code.

Public exploit code: 1 Exploit-DB entry.

Other vulnerabilities in SonicWall NetExtender

• CVE-2023-44218 Privilege escalation in NetExtender High 8.8
• CVE-2023-44217 Privilege escalation in NetExtender High 7.8
• CVE-2022-22281 Memory corruption in SonicWall NetExtender Windows (32 and 64 bit) Client High 7.8
• CVE-2020-5131 Path traversal in SonicWall NetExtender High 7.8
• CVE-2023-44220 Other in NetExtender High 7.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-hqm7-vfw5-95rq.