Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-34902

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.4 (39316) Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Desktop Control Agent service. The service loads Qt plugins from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-15787.

Published

2022-07-18T15:15:08.780

Last Modified

2024-11-21T07:10:24.113

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.8 (HIGH)

Weaknesses

Type: Secondary
CWE-427

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	parallels	parallels_access	6.5.4_\(39316\)	Yes

References

https://kb.parallels.com/en/129010 Vendor Advisory ([email protected])
https://www.zerodayinitiative.com/advisories/ZDI-22-946/ Third Party Advisory, VDB Entry ([email protected])
https://kb.parallels.com/en/129010 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.zerodayinitiative.com/advisories/ZDI-22-946/ Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)