CVE-2021-25269 Privilege escalation in Intercept X Advanced
A local administrator can prevent the HMPA service from starting via an unquoted service path, bypassing tamper protection in Sophos Intercept X.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-25269?
CVE-2021-25269 is a medium-severity vulnerability in Sophos Intercept X Advanced, published on 26 Nov 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A local administrator could prevent the HMPA service from starting despite tamper protection using an unquoted service path vulnerability in the HMPA component of Sophos Intercept X Advanced and Sophos Intercept X Advanced for Server before version 2.0.23, as well as Sophos Exploit Prevention before version 3.8.3.
Weakness: CWE-428
Which versions are affected by CVE-2021-25269?
It affects 3 products.
Products include Sophos Exploit Prevention, Sophos Intercept X Endpoint, Sophos Intercept X for Server.
How do I fix CVE-2021-25269?
No fix has been published for CVE-2021-25269 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-25269 being exploited?
There is no known exploitation of CVE-2021-25269 in the wild and no public exploit code.
Sources
Also known as GHSA-cvpr-72qq-65cc.