CVE-2021-34998
High
Description
This vulnerability allows local attackers to escalate privileges on affected installations of Panda Security Free Antivirus 20.2.0.0. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the use of named pipes. The issue results from allowing an untrusted process to impersonate the client of a pipe. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-14208.
SeverityHigh
CVSS7.8
Exploit probability—
ProductWatchguard Panda Antivirus
PublishedJan 13, 2022
First seenJan 13, 2022
Weakness typeCWE-250CWE-250
How to fix
Update
- watchguard panda_antivirus20.02.00 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| watchguard panda_antivirus | v < 20.02.00 | 20.02.00 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.