Local Code Execution Vulnerability in Sophos Endpoint for MacOS
CVE-2021-25264

6.7MEDIUM

Key Information:

Vendor

Sophos
Status
Intercept X For Mac OS
Intercept X For Mac OS (opm)
Sophos Home For Mac OS
Vendor
CVE Published:
17 May 2021

What is CVE-2021-25264?

A local code execution vulnerability exists in multiple versions of Sophos Endpoint products for MacOS. An attacker with local access could exploit this flaw to execute arbitrary code with administrative privileges, potentially allowing for unauthorized actions on the affected system. Users are advised to review their endpoint protection measures and apply necessary updates to mitigate potential risks.

Affected Version(s)

Intercept X for MacOS <= 10.0.3

Intercept X for MacOS (OPM) <= 9.10.1

Sophos Home for MacOS <= 10.0.3

References

https://community.sophos.com/b/security-blog
x_refsource_MISC
https://community.sophos.com/b/security-blog/posts/resolv...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Csaba Fitzl
.