CVE-2018-10722

HIGH

CylancePROTECT < 1470 - Unauthenticated Privilege Escalation via Symlink Chain in Log Folder

Title source: llm
STIX 2.1

Description

In Cylance CylancePROTECT before 1470, an unprivileged local user can obtain SYSTEM privileges because users have Modify access to the %PROGRAMFILES%\Cylance\Desktop\log folder, the CyUpdate process grants users Modify access to new files created in this folder, and a new file can be a symlink chain to a pathname of an arbitrary DLL that CyUpdate uses.

References (1)

Core 1
Core References
Exploit, Technical Description, Third Party Advisory x_refsource_misc
https://www.atredis.com/blog/cylance-privilege-escalation-vulnerability

Scores

CVSS v3 7.8
EPSS 0.0055
EPSS Percentile 41.6%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-59
Status published
Products (1)
cylance/cylanceprotect < 1470
Published May 04, 2018
Tracked Since Feb 18, 2026