Insecure DLL loading in Kaspersky Security Center Web Console and Kaspersky Security Center - CVE-2020-25045
Published: September 2, 2020 / Updated: October 6, 2020
Vulnerability identifier: #VU47340
CSH Severity: Low
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-25045
CWE-ID: CWE-427
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local attacker to compromise vulnerable system.
The vulnerability exists due to the application loads DLL libraries in an insecure manner. A local attacker can place a specially crafted .dll file, trick the victim into opening a file, associated with the vulnerable application, and execute arbitrary code on victim's system, leading to privilege escalation.
Affected software
Kaspersky Security Center Web Console
Kaspersky Security Center
Kaspersky Security Center
How to mitigate CVE-2020-25045
Install updates from vendor's website.
Kaspersky Security Center - update to 12