PT-2023-12109 · Zscaler · Zscaler Client Connector

Published 2023-10-23 · Updated 2023-10-27 · CVE-2021-26736

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zscaler Client Connector Installer and Uninstaller for Windows versions prior to 3.6

Description Multiple vulnerabilities in the Zscaler Client Connector Installer and Uninstaller for Windows allowed execution of binaries from a low privileged path. A local adversary may be able to execute code with SYSTEM privileges.

Recommendations For versions prior to 3.6, update to version 3.6 or later to resolve the issue. As a temporary workaround, consider restricting access to low privileged paths to minimize the risk of exploitation.

Fix

RCE

Path traversal

Weakness Enumeration

CWE-20

CWE-22

Related Identifiers

CVE-2021-26736

Affected Products

Zscaler Client Connector

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-26736 · Security Note
• https://osv.dev/vulnerability/CVE-2021-26736 · Vendor Advisory
• https://help.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2021 · Note
• https://t.me/cibsecurity/72779 · Telegram Post
• https://twitter.com/CVEnew/status/1716448947693092877 · Twitter Post
• https://twitter.com/DMFezzaReedCISA/status/1716488473090183660 · Twitter Post