Security Control Bypass in Symantec Endpoint Protection Windows Agent
CVE-2022-37017

7.5HIGH

Key Information:

Vendor

Broadcom
Status
Symantec Endpoint Protection
Vendor
CVE Published:
1 December 2022

What is CVE-2022-37017?

The Symantec Endpoint Protection (Windows) agent is prone to a vulnerability that enables attackers to bypass crucial security controls, specifically targeting Client User Interface Password protection and Policy Import/Export Password protection, provided these features are enabled. This flaw underscores the importance of keeping security products updated and correctly configured to protect against unauthorized access.

Affected Version(s)

Symantec Endpoint Protection 14.3 RU5

References

https://support.broadcom.com/web/ecx/support-content-noti...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.