CVEvulnerability
CVE-2021-33436
7.3 HIGH
Official page ↗
- Status
- Modified
- Published
- 2022-04-28
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.3 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.2 MEDIUM — AV:L/AC:H/Au:N/C:C/I:C/A:C
Description
NoMachine for Windows prior to version 6.15.1 and 7.5.2 suffer from local privilege escalation due to the lack of safe DLL loading. This vulnerability allows local non-privileged users to perform DLL Hijacking via any writable directory listed under the system path and ultimately execute code as NT AUTHORITY\SYSTEM.
Affected configurations
• nomachine nomachine (>= 6.0.0 < 6.15.1)
• nomachine nomachine (>= 7.0 < 7.5.2)
References
- https://github.com/active-labs/Advisories/blob/master/2021/ACTIVE-2021-001.md Third Party Advisory
- https://knowledgebase.nomachine.com/SU05S00223 Release Notes, Vendor Advisory
- https://knowledgebase.nomachine.com/SU05S00224 Release Notes, Vendor Advisory
- https://knowledgebase.nomachine.com/TR05S10236 Vendor Advisory
- https://github.com/active-labs/Advisories/blob/master/2021/ACTIVE-2021-001.md Third Party Advisory
- https://knowledgebase.nomachine.com/SU05S00223 Release Notes, Vendor Advisory
- https://knowledgebase.nomachine.com/SU05S00224 Release Notes, Vendor Advisory
- https://knowledgebase.nomachine.com/TR05S10236 Vendor Advisory