Tamper Protection Bypass in Sophos Endpoint Protection 10.7
CVE-2018-4863

5.5MEDIUM

Key Information:

Vendor

Sophos
Status
Endpoint Protection
Vendor
CVE Published:
5 April 2018

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2018-4863?

Sophos Endpoint Protection 10.7 has a vulnerability that allows local users to circumvent its tamper protection mechanism. This can be achieved by deleting a specific registry key located at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Sophos Endpoint Defense. This exploit enables unauthorized users to disable security features, undermining the effectiveness of the endpoint protection and potentially leading to further system compromises.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2018-4863 - Proof of Concept

References

https://www.exploit-db.com/exploits/44410/
exploitx_refsource_EXPLOIT-DB
http://hyp3rlinx.altervista.org/advisories/SOPHOS-ENDPOIN...
x_refsource_MISC
http://seclists.org/fulldisclosure/2018/Apr/6
mailing-listx_refsource_FULLDISC

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

JSON
.