PT-2020-14927 · Anchorfree · Hotspot Shield Vpn

Published 2020-09-24 · Updated 2020-10-23 · CVE-2020-17365

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hotspot Shield VPN client software versions 10.3.0 and earlier

Description The issue is related to improper directory permissions, which may allow an authorized user to potentially enable escalation of privilege via local access. This could allow a local user to corrupt system files by creating a specially crafted symbolic link to a critical file on the system and overwriting it with privileges of the application.

Recommendations For versions 10.3.0 and earlier, update to a version later than 10.3.0 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Link Following

Incorrect Permission

Weakness Enumeration

CWE-59

CWE-732

Related Identifiers

CVE-2020-17365

Affected Products

Hotspot Shield Vpn

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2020-17365 · Security Note
• https://pango.co/sec31944 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-17365 · Vendor Advisory
• https://t.me/defcon_news/59930 · Telegram Post
• https://t.me/canyoupwnme/6653 · Telegram Post
• https://t.me/thebugbountyhunter/4818 · Telegram Post
• https://t.me/cybersecuritytechnologies/1967 · Telegram Post
• https://cymptom.com/cve-2020-17365-hotspot-shield-vpn-new-privilege-escalation-vulnerability/2020/10 · Note
• https://t.me/rnetsec/13608 · Telegram Post