ByteOS Network

NVD Vulnerability Details :

CVE-2021-26624

Analyzed

Source-vuln@krcert.or.kr

Published At-01 Apr, 2022 | 23:15

Updated At-09 Apr, 2022 | 00:42

An local privilege escalation vulnerability due to a "runasroot" command in eScan Anti-Virus. This vulnerability is due to invalid arguments and insufficient execution conditions related to "runasroot" command. This vulnerability can induce remote attackers to exploit root privileges by manipulating parameter values.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Secondary	3.1	7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	10.0	HIGH	AV:N/AC:L/Au:N/C:C/I:C/A:C

CPE Matches

escanav>>escan_anti-virus>>Versions before 7.0.31(exclusive)

cpe:2.3:a:escanav:escan_anti-virus:*:*:*:*:*:linux:*:*

Weaknesses

CWE ID	Type	Source
CWE-20	Primary	nvd@nist.gov
CWE-20	Secondary	vuln@krcert.or.kr

References

Hyperlink	Source	Resource
https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66596	vuln@krcert.or.kr	Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History