CVE-2019-18194

HIGH

TotalAV 2020 4.14.31 - Privilege Escalation via Quarantine NTFS Directory Junction

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2019-18194. PoCs published by Kusol Watchara-Apanukorn.

AI-analyzed exploit summary This is a writeup describing a privilege escalation vulnerability in TotalAV 2020 4.14.31 due to a quarantine flaw exploitable via NTFS directory junction. The PoC involves planting a malicious DLL, triggering its quarantine, and restoring it via a junction to escalate privileges.

Description

TotalAV 2020 4.14.31 has a quarantine flaw that allows privilege escalation. Exploitation uses an NTFS directory junction to restore a malicious DLL from quarantine into the system32 folder.

Exploits (1)

exploitdb WRITEUP VERIFIED
by Kusol Watchara-Apanukorn · textlocalwindows
https://www.exploit-db.com/exploits/47897

This is a writeup describing a privilege escalation vulnerability in TotalAV 2020 4.14.31 due to a quarantine flaw exploitable via NTFS directory junction. The PoC involves planting a malicious DLL, triggering its quarantine, and restoring it via a junction to escalate privileges.

Classification
Writeup 90%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: TotalAV 2020 4.14.31
No auth needed
Prerequisites: Malicious DLL file · TotalAV 2020 4.14.31 installed · NTFS directory junction creation capability
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2
Core References
Exploit, Third Party Advisory x_refsource_misc
https://www.youtube.com/watch?v=88qeaLq98Gc

Scores

CVSS v3 7.8
EPSS 0.0221
EPSS Percentile 80.3%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

Status published
Products (1)
totalav/totalav_2020 4.14.31
Published Jan 10, 2020
Tracked Since Feb 18, 2026