Remote Code Execution Vulnerability in Zscaler Client Connector
CVE-2020-11635

7.8HIGH

Key Information:

Vendor

Zscaler

Status
Zscaler Client Connector For Windows
Vendor
CVE Published:
16 February 2021

What is CVE-2020-11635?

The Zscaler Client Connector prior to version 3.1.0 is susceptible to a security flaw that arises from inadequate validation of RPC clients. This oversight potentially enables a local adversary to execute arbitrary code with system-level privileges, allowing them to perform unauthorized actions not typically granted to their user account. This vulnerability raises significant security concerns, especially in environments where the Zscaler Client Connector is deployed.

Affected Version(s)

Zscaler Client Connector for Windows < 3.1.0

References

https://trust.zscaler.com/posts/7316
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.