CVE-2022-41604 Privilege escalation in n/a
Local attackers can escalate privileges to SYSTEM by exploiting weak directory permissions and a driver bypass in ZoneAlarm Extreme Security.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-41604?
CVE-2022-41604 is a high-severity vulnerability in n/a, published on 27 Sep 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. This occurs because of weak permissions for the %PROGRAMDATA%\CheckPoint\ZoneAlarm\Data\Updates directory, and a self-protection driver bypass that allows creation of a junction directory. This can be leveraged to perform an arbitrary file move as NT AUTHORITY\SYSTEM.
Weakness: CWE-269
Which versions are affected by CVE-2022-41604?
It affects 1 product.
Products include Checkpoint Zonealarm.
How do I fix CVE-2022-41604?
No fix has been published for CVE-2022-41604 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-41604 being exploited?
There is no known exploitation of CVE-2022-41604 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-xf3m-h4qp-mpv8.