Vulnerability Description
Untrusted search path vulnerability in Installer of MagicConnect Client program distributed before 2021 March 1 allows an attacker to gain privileges and via a Trojan horse DLL in an unspecified directory and to execute arbitrary code with the privilege of the user invoking the installer when a terminal is connected remotely using Remote desktop.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ntt-Tx | Magicconnect | < 2021-03-01 |
Related Weaknesses (CWE)
References
- https://jvn.jp/en/jp/JVN18056666/index.htmlThird Party Advisory
- https://www.magicconnect.net/information/202103110900-2Vendor Advisory
- https://jvn.jp/en/jp/JVN18056666/index.htmlThird Party Advisory
- https://www.magicconnect.net/information/202103110900-2Vendor Advisory
FAQ
What is CVE-2021-20674?
CVE-2021-20674 is a vulnerability with a CVSS score of 7.8 (HIGH). Untrusted search path vulnerability in Installer of MagicConnect Client program distributed before 2021 March 1 allows an attacker to gain privileges and via a Trojan horse DLL in an unspecified direc...
How severe is CVE-2021-20674?
CVE-2021-20674 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-20674?
Check the references section above for vendor advisories and patch information. Affected products include: Ntt-Tx Magicconnect.