CVE-2022-37017 Security feature bypass in Symantec Endpoint Protection

What is CVE-2022-37017?

CVE-2022-37017 is a high-severity vulnerability in Symantec Endpoint Protection, published on 1 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Symantec Endpoint Protection (Windows) agent, prior to 14.3 RU6/14.3 RU5 Patch 1, may be susceptible to a Security Control Bypass vulnerability, which is a type of issue that can potentially allow a threat actor to circumvent existing security controls. This CVE applies narrowly to the Client User Interface Password protection and Policy Import/Export Password protection, if it has been enabled.

Which versions are affected by CVE-2022-37017?

It affects 1 product.

Products include Broadcom Symantec Endpoint Protection.

How do I fix CVE-2022-37017?

No fix has been published for CVE-2022-37017 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-37017 being exploited?

There is no known exploitation of CVE-2022-37017 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in Symantec Endpoint Protection

• CVE-2022-37016 Privilege escalation in Symantec Endpoint Protection Critical 9.8
• CVE-2022-25631 Privilege escalation in Symantec Endpoint Protection High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xrrv-gjcc-h93v.