CVEvulnerability
CVE-2021-31776
7.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2021-04-29
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.2 HIGH — AV:L/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-428
Description
Aviatrix VPN Client before 2.14.14 on Windows has an unquoted search path that enables local privilege escalation to the SYSTEM user, if the machine is misconfigured to allow unprivileged users to write to directories that are supposed to be restricted to administrators.
Affected configurations
• aviatrix vpn client (< 2.14.14)
Related
Weakness · CWE (1)
- CWE-428 Unquoted Search Path or Element weakness
References
- https://docs.aviatrix.com/Downloads/samlclient.html Product, Vendor Advisory
- https://docs.aviatrix.com/Downloads/samlclient.html#windows-win Product, Vendor Advisory
- https://docs.aviatrix.com/HowTos/changelog.html#aviatrix-vpn-client-changelog Release Notes, Vendor Advisory
- https://docs.aviatrix.com/Downloads/samlclient.html Product, Vendor Advisory
- https://docs.aviatrix.com/Downloads/samlclient.html#windows-win Product, Vendor Advisory
- https://docs.aviatrix.com/HowTos/changelog.html#aviatrix-vpn-client-changelog Release Notes, Vendor Advisory