DLL Hijacking Vulnerability in Panda Security VPN for Windows
CVE-2023-37849

6.5MEDIUM

Key Information:

Vendor

Watchguard

Status
Panda Security Vpn
Vendor
CVE Published:
13 July 2023

What is CVE-2023-37849?

A significant DLL hijacking vulnerability has been identified in Panda Security VPN for Windows. Attackers could exploit this vulnerability by placing a specially crafted DLL file in the same directory as the legitimate PANDAVPN.exe file. This unauthorized manipulation can lead to the execution of arbitrary code, jeopardizing the security of the system and potentially allowing its full compromise. Users are encouraged to update to version v15.14.8 or later to mitigate this risk.

References

https://heegong.github.io/posts/Local-privilege-escalatio...
https://www.pandasecurity.com/en/support/card?id=100080
https://www.pandasecurity.com/en/homeusers/vpn/

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.