Local Privilege Escalation Vulnerability in Forescout CounterACT Logging Function

CVE-2021-28098

What is CVE-2021-28098?

A local privilege escalation vulnerability exists in Forescout CounterACT due to improper permissions on the log file created by SecureConnector. The application's logging function writes logs to a directory with full permissions accessible to all users, which enables an attacker to exploit the vulnerability using symbolic links. By redirecting the log file to a sensitive location like %WINDIR%\System32, the attacker can manipulate file permissions and potentially replace legitimate files with malicious DLLs, facilitating DLL hijacking attacks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References