CVE-2021-31776 Privilege escalation in n/a
Local attackers can escalate privileges to SYSTEM via unquoted search path in Aviatrix VPN Client on misconfigured Windows systems.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-31776?
CVE-2021-31776 is a high-severity vulnerability in n/a, published on 29 Apr 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Aviatrix VPN Client before 2.14.14 on Windows has an unquoted search path that enables local privilege escalation to the SYSTEM user, if the machine is misconfigured to allow unprivileged users to write to directories that are supposed to be restricted to administrators.
Weakness: CWE-428
Which versions are affected by CVE-2021-31776?
It affects 1 product.
Products include Aviatrix Vpn Client.
How do I fix CVE-2021-31776?
No fix has been published for CVE-2021-31776 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-31776 being exploited?
There is no known exploitation of CVE-2021-31776 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-5m6v-4w72-r82q.