SB2026013030 - Privilege escalation in NCP Secure Entry Client for Windows

Description

This security bulletin contains information about 1 vulnerability.

1) Exposed dangerous method or function (CVE-ID: N/A)

CWE-ID: CWE-749 - Exposed Dangerous Method or Function

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to during certain actions, such as installation, update, or uninstallation of the VPN client, the command line windows (cmd.exe) are temporarily opened with the SYSTEM account privileges. A local user can interact with the opened command line directly and execute arbitrary code, leading to privilege escalation. 

Remediation

Install update from vendor's website.

References

• https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00002
• https://www.ncp-e.com/fileadmin/_NCP/pdf/library/release_notes/NCP_Secure_Clients/NCP_Secure_Entry_Client/en/NCP_RN_Win_Secure_Entry_Client_13_33_r9750_en.pdf