CVE-2018-20341 Information

Description

WINMAGIC SecureDoc Disk Encryption software before 8.3 has an Unquoted Service Path vulnerability which could allow an attacker to execute arbitrary code on a target system. If the executable is enclosed in quote tags \ then the system will know where to find it. However if the path of where the application binary is located doesn’t contain any quotes then Windows will try to find it and execute it inside every folder of this path until they reach the executable.

CVSS Vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Reference

http://downloads.winmagic.info/manuals/Release_Notes_8.3.pdf

Attack Complexity

LOW

Privileges Required

LOW

User Interaction Required

LOW

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

7.8