RCE in Mcafee Endpoint Security
CVE-2019-3652
Code Injection vulnerability in EPSetup.exe in McAfee Endpoint Security (ENS) Prior to 10.6.1 October 2019 Update allows local user to get their malicious code installed by the ENS installer via code injection into EPSetup.exe by an attacker with access to the installer.
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.003 (24.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.0 (Medium). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L.
Affected products
- Mcafee Endpoint_security — versions 10.6.1
- Mcafee, Llc Mcafee Endpoint Security (Ens) — versions 10.6.x, 10.5.x
- Microsoft Windows
Weakness classification (CWE)
Public proof-of-concept exploits
References
- trellixpsirt@trellix.com (x_refsource_CONFIRM)
Frequently asked questions
- What is CVE-2019-3652?
- CVE-2019-3652 is a medium-severity vulnerability in Mcafee Endpoint Security, classified under Code Injection. CVSS score: 5.0/10. Published 2019-10-09.
- How severe is CVE-2019-3652?
- Medium severity. CVSS v3 base score is 5.0 out of 10.
- Is CVE-2019-3652 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.