Vulnerability in Microsoft Windows
CVE-2020-26155
Multiple files and folders in Utimaco SecurityServer 4.20.0.4 and 4.31.1.0. are installed with Read/Write permissions for authenticated users, which allows for binaries to be manipulated by non-administrator users. Additionally, entries are made to the PATH environment variable which, in conjunction with these weak permissions, could enable an attacker to perform a DLL hijacking attack.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.004 (27.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 28th percentile — 27.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- Microsoft Windows
- Utimaco Block-Safe Firmware — versions 2.0.0, 3.0.0
- Utimaco Cryptoserver Cp5 Firmware — versions 5.0.0.0, 5.1.0.0
- Utimaco Cryptoserver Cp5 Vs-Nfd Firmware — versions 5.1.0.0
- Utimaco Paymentserver Firmware
- Utimaco Paymentserver Hybrid Firmware
- Utimaco Securityserver Firmware
Weakness classification (CWE)
References
- hsm.utimaco.com/products-hardware-security-modules/general-purpose-hsm/ (Exploit, Vendor Advisory)
- secureyourit.co.uk/wp/2021/03/13/utimaco-cve-2020-26155/ (Third Party Advisory)
Frequently asked questions
- What is CVE-2020-26155?
- CVE-2020-26155 is a high-severity vulnerability in Microsoft Windows, classified under Uncontrolled Search Path Element. CVSS score: 7.8/10. Published 2021-03-18.
- How severe is CVE-2020-26155?
- High severity. CVSS v3 base score is 7.8 out of 10.