CVE-2020-11634

HIGH

Zscaler Client Connector < 2.1.2.105 - Uncontrolled Search Path

Title source: rule

Description

The Zscaler Client Connector for Windows prior to 2.1.2.105 had a DLL hijacking vulnerability caused due to the configuration of OpenSSL. A local adversary may be able to execute arbitrary code in the SYSTEM context.

References (1)

[Release Notes, Vendor Advisory] https://help.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2020?applicable_category=Windows&applicable_version=2.1.2.105

Scores

CVSS v3 7.8

EPSS 0.0006

EPSS Percentile 19.9%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Classification

CWE

CWE-427

Status published

Affected Products (1)

zscaler/client_connector < 2.1.2.105

Timeline

Published Jul 15, 2021

Tracked Since Feb 18, 2026