CVE-2020-5837

HIGH

Symantec Endpoint Protection <14.3 - Privilege Escalation

Title source: llm

Description

Symantec Endpoint Protection, prior to 14.3, may not respect file permissions when writing to log files that are replaced by symbolic links, which can lead to a potential elevation of privilege.

Exploits (1)

nomisec WORKING POC 43 stars

by RedyOpsResearchLabs · poc

https://github.com/RedyOpsResearchLabs/SEP-14.2-Arbitrary-Write

View Code ZIP pw:eip

References (1)

[Vendor Advisory] https://support.broadcom.com/security-advisory/security-advisory-detail.html?notificationId=SYMSA1762

Scores

CVSS v3 7.8

EPSS 0.0177

EPSS Percentile 82.4%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-59

Status published

Affected Products (1)

symantec/endpoint_protection < 14.3

Timeline

Published May 11, 2020

Tracked Since Feb 18, 2026