PT-2021-17121 · Panda · Panda Agent+1

Florian Hansemann · Published 2021-09-23 · Updated 2021-09-30 · CVE-2021-26750

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Panda Agent versions 1.16.11 and earlier Panda Adaptive Defense 360 versions 8.0.17 and earlier

Description The issue allows an attacker to escalate privileges via a maliciously crafted DLL file. This is achieved through DLL hijacking in the affected software.

Recommendations For Panda Agent versions 1.16.11 and earlier, update to a version later than 1.16.11 to resolve the issue. For Panda Adaptive Defense 360 versions 8.0.17 and earlier, update to a version later than 8.0.17 to resolve the issue. As a temporary workaround, consider restricting the use of potentially vulnerable DLL files until a patch is available.

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2021-26750

Affected Products

Panda Adaptive Defense 360

Panda Agent

References · 4

• https://osv.dev/vulnerability/CVE-2021-26750 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26750 · Security Note
• https://t.me/cibsecurity/29311 · Telegram Post
• https://hansesecure.de/2021/02/vulnerability-in-panda-security-product/?lang=en · Note