CVE-2020-14418

CVE Database · CVE-2020-14418

CVE-2020-14418

· HIGHModified

CVSS v3.1

7.0

EPSS

0.34%

Published

Jan 30, 2021

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

A TOCTOU vulnerability exists in madCodeHook before 2020-07-16 that allows local attackers to elevate their privileges to SYSTEM. This occurs because path redirection can occur via vectors involving directory junctions.

CVSS Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-367

Affected Products (4)

cisco · advanced_malware_protection (up to 7.2.13)vulnerable

madshi · madcodehook (up to 4.1.3)vulnerable

morphisec · unified_threat_prevention_platform (up to 3.5.9)vulnerable

morphisec · unified_threat_prevention_platform (up to 4.1.2)vulnerable

References (4)

https://github.com/nettitude/metasploit-modules

ProductThird Party Advisory

https://labs.nettitude.com/blog/cve-2020-14418-madcodehook-library-local-privilege-escalation/

ExploitThird Party Advisory

https://github.com/nettitude/metasploit-modules

ProductThird Party Advisory

https://labs.nettitude.com/blog/cve-2020-14418-madcodehook-library-local-privilege-escalation/

ExploitThird Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs