CVE-2020-7263
ENS configuration can be edited by attacker with local administrator permissions
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Improper access control vulnerability in ESconfigTool.exe in McAfee Endpoint Security (ENS) for Windows all current versions allows local administrator to alter ENS configuration up to and including disabling all protection offered by ENS via insecurely implemented encryption of configuration for export and import.
Timeline
- CVE published
- Record last updated
Affected versions
- McAfee, LLC Endpoint Security (ENS) for Window
From 10.7.x · through ENS 10.7.0 July 2020 Update; From 10.6.x · through ENS 10.6.1 July 2020 Update