CVE-2021-35523 Privilege escalation in n/a
Local attackers can escalate privileges to SYSTEM by modifying OpenVPN configuration files to execute arbitrary scripts in Securepoint SSL VPN Client.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-35523?
CVE-2021-35523 is a high-severity vulnerability in n/a, published on 28 Jun 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Securepoint SSL VPN Client v2 before 2.0.32 on Windows has unsafe configuration handling that enables local privilege escalation to NT AUTHORITY\SYSTEM. A non-privileged local user can modify the OpenVPN configuration stored under "%APPDATA%\Securepoint SSL VPN" and add a external script file that is executed as privileged user.
Weakness: CWE-269
Which versions are affected by CVE-2021-35523?
It affects 1 product.
Products include Securepoint Openvpn-Client.
How do I fix CVE-2021-35523?
No fix has been published for CVE-2021-35523 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-35523 being exploited?
There is no known exploitation of CVE-2021-35523 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-v8p8-4w8f-qh34.