CVE-2016-3943

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2016-3943
Panda Endpoint Administration Agent before 7.50.00, as used in Panda Security for Business products for Windows, uses a weak ACL for the Panda Security/WaAgent directory and sub-directories, which allows local users to gain SYSTEM privileges by modifying an executable module.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.2 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
http://packetstormsecurity.com/files/136606/Panda-Endpoint-Administration-Agent-Privilege-Escalation.html Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2016/Apr/24 Mailing List Third Party Advisory
https://www.exploit-db.com/exploits/39671/ Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/136606/Panda-Endpoint-Administration-Agent-Privilege-Escalation.html Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2016/Apr/24 Mailing List Third Party Advisory
https://www.exploit-db.com/exploits/39671/ Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:watchguard:panda_endpoint_administration_agent:*:*:*:*:*:*:*:*
History

21 Nov 2024, 02:50

Type Values Removed Values Added
References () http://packetstormsecurity.com/files/136606/Panda-Endpoint-Administration-Agent-Privilege-Escalation.html - Third Party Advisory, VDB Entry () http://packetstormsecurity.com/files/136606/Panda-Endpoint-Administration-Agent-Privilege-Escalation.html - Third Party Advisory, VDB Entry
References () http://seclists.org/fulldisclosure/2016/Apr/24 - Mailing List, Third Party Advisory () http://seclists.org/fulldisclosure/2016/Apr/24 - Mailing List, Third Party Advisory
References () https://www.exploit-db.com/exploits/39671/ - Third Party Advisory, VDB Entry () https://www.exploit-db.com/exploits/39671/ - Third Party Advisory, VDB Entry

09 Sep 2021, 17:31

Type Values Removed Values Added
References (EXPLOIT-DB) https://www.exploit-db.com/exploits/39671/ - (EXPLOIT-DB) https://www.exploit-db.com/exploits/39671/ - Third Party Advisory, VDB Entry
References (MISC) http://packetstormsecurity.com/files/136606/Panda-Endpoint-Administration-Agent-Privilege-Escalation.html - (MISC) http://packetstormsecurity.com/files/136606/Panda-Endpoint-Administration-Agent-Privilege-Escalation.html - Third Party Advisory, VDB Entry
References (FULLDISC) http://seclists.org/fulldisclosure/2016/Apr/24 - (FULLDISC) http://seclists.org/fulldisclosure/2016/Apr/24 - Mailing List, Third Party Advisory
CWE CWE-254 CWE-276
CPE cpe:2.3:a:pandasecurity:panda_endpoint_administration_agent:*:*:*:*:*:*:*:* cpe:2.3:a:watchguard:panda_endpoint_administration_agent:*:*:*:*:*:*:*:*
Information

Published : 2016-04-18 15:59

Updated : 2025-04-12 10:46

NVD link : CVE-2016-3943

Mitre link : CVE-2016-3943

CVE.ORG link : CVE-2016-3943

JSON object : View

Products Affected

watchguard

  • panda_endpoint_administration_agent
CWE
CWE-276

Incorrect Default Permissions