PT-2019-18628 · Microsoft+1 · Windows+1

Published 2019-12-19 · Updated 2020-01-08 · CVE-2019-7487

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SonicOS SSLVPN NACagent version 3.5

Description The issue arises during the installation of the SonicOS SSLVPN NACagent on the Windows operating system. An autorun value is created without quotes around the path, which could allow a malicious binary placed by an attacker within the parent path to execute code.

Recommendations For SonicOS SSLVPN NACagent version 3.5, consider manually adding quotes around the path in the autorun value to prevent potential code execution by malicious binaries. As a temporary workaround, restrict access to the parent path to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-428

Related Identifiers

CVE-2019-7487

Affected Products

Sonicos Sslvpn Nacagent

Windows

References · 3

• https://osv.dev/vulnerability/CVE-2019-7487 · Vendor Advisory
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0022 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-7487 · Security Note