CVE-2017-9606 Infotecs ViPNet Client and Coordinator before 4.3.2-42442 allow local users to gain privileges by placing a Trojan horse ViPNet update file in the update folder. The attack succeeds because of incorre...
HighCVSS 7.3
EPSS 0.30%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Infotecs ViPNet Client and Coordinator before 4.3.2-42442 allow local users to gain privileges by placing a Trojan horse ViPNet update file in the update folder. The attack succeeds because of incorrect folder permissions in conjunction with a lack of integrity and authenticity checks.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| infotecs vipnet client | <= 4.3.1 | No fix listed |
| infotecs vipnet coordinator | <= 4.3.1 | No fix listed |
References
- github.com third-party-advisory