PT-2021-12386 · Sonicwall · Sonicwall Netextender

Published 2021-01-09 · Updated 2021-09-21 · CVE-2020-5147

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions SonicWall NetExtender Windows client versions 10.2.300 and earlier

Description The SonicWall NetExtender Windows client is affected by an unquoted service path vulnerability. This issue allows a local attacker to gain elevated privileges in the host operating system.

Recommendations For versions 10.2.300 and earlier, update to a version later than 10.2.300 to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable service path to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-428

Related Identifiers

CVE-2020-5147

Affected Products

Sonicwall Netextender

References · 8

• 🔥 http://packetstormsecurity.com/files/163857/SonicWall-NetExtender-10.2.0.300-Unquoted-Service-Path.html · Exploit
• 🔥 https://exploit-db.com/exploits/50212 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-5147 · Security Note
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0023 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-5147 · Vendor Advisory
• https://t.me/cibsecurity/21880 · Telegram Post
• https://t.me/cvenotify/8404 · Telegram Post
• https://t.me/cvenotify/8379 · Telegram Post