Vulnerability Description
SUPERAntiSyware Professional X Trial 10.0.1206 is vulnerable to local privilege escalation because it allows unprivileged users to restore a malicious DLL from quarantine into the system32 folder via an NTFS directory junction, as demonstrated by a crafted ualapi.dll file that is detected as malware.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Superantispyware | Professional X | < 10.0.1206 |
Related Weaknesses (CWE)
References
- https://github.com/b1nary0x1Third Party Advisory
- https://www.youtube.com/watch?v=jdcqbev-H5IExploitThird Party Advisory
- https://github.com/b1nary0x1Third Party Advisory
- https://www.youtube.com/watch?v=jdcqbev-H5IExploitThird Party Advisory
FAQ
What is CVE-2020-24955?
CVE-2020-24955 is a vulnerability with a CVSS score of 7.8 (HIGH). SUPERAntiSyware Professional X Trial 10.0.1206 is vulnerable to local privilege escalation because it allows unprivileged users to restore a malicious DLL from quarantine into the system32 folder via ...
How severe is CVE-2020-24955?
CVE-2020-24955 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-24955?
Check the references section above for vendor advisories and patch information. Affected products include: Superantispyware Professional X.