Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-12042

Insecure permissions of the section object Global\PandaDevicesAgentSharedMemory and the event Global\PandaDevicesAgentSharedMemoryChange in Panda products before 18.07.03 allow attackers to queue an event (as an encrypted JSON string) to the system service AgentSvc.exe, which leads to privilege escalation when the CmdLineExecute event is queued. This affects Panda Antivirus, Panda Antivirus Pro, Panda Dome, Panda Global Protection, Panda Gold Protection, and Panda Internet Security.

Published

2019-05-23T14:29:07.673

Last Modified

2024-11-21T04:22:09.413

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 9.8 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

10.0

Impact Score

10.0

Weaknesses
  • Type: Primary
    CWE-732
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application pandasecurity panda_antivirus < 18.07.03 Yes
Application pandasecurity panda_antivirus_pro < 18.07.03 Yes
Application pandasecurity panda_dome < 18.07.03 Yes
Application pandasecurity panda_global_protection < 18.07.03 Yes
Application pandasecurity panda_gold_protection < 18.07.03 Yes
Application pandasecurity panda_internet_security < 18.07.03 Yes
References