CVE-2020-15261
HIGHEPSS 95th pctlDescription
On Windows the Veyon Service before version 4.4.2 contains an unquoted service path vulnerability, allowing locally authenticated users with administrative privileges to run malicious executables with LocalSystem privileges. Since Veyon users (both students and teachers) usually don't have administrative privileges, this vulnerability is only dangerous in anyway unsafe setups. The problem has been fixed in version 4.4.2. As a workaround, the exploitation of the vulnerability can be prevented by revoking administrative privileges from all potentially untrustworthy users.
CVSS v3 Vector
Exploitability
Impact
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Exploit Intelligence
Very high risk: more likely to be exploited than 95% of all known CVEs.
References
- http://packetstormsecurity.com/files/162873/Veyon-4.4.1-Unquoted-Service-Path.html
- https://github.com/veyon/veyon/commit/f231ec511b9a09f43f49b2c7bb7c60b8046276b1
- https://github.com/veyon/veyon/issues/657
- https://github.com/veyon/veyon/security/advisories/GHSA-c8cc-x786-hqqp
- https://www.exploit-db.com/exploits/48246
- https://www.exploit-db.com/exploits/49925
Find and fix vulnerabilities across your fleet
TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.
Start freeThis product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2024-11-21.