CVE-2020-5837

HIGH

Symantec Endpoint Protection <14.3 - Privilege Escalation

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2020-5837. PoCs published by RedyOpsResearchLabs.

AI-analyzed exploit summary This repository contains a functional exploit for CVE-2020-5837, targeting Symantec Endpoint Protection (SEP) 14.2. The exploit leverages arbitrary write vulnerabilities via symbolic link manipulation, based on James Forshaw's symboliclink-testing-tools.

Description

Symantec Endpoint Protection, prior to 14.3, may not respect file permissions when writing to log files that are replaced by symbolic links, which can lead to a potential elevation of privilege.

Exploits (1)

nomisec WORKING POC 43 stars
by RedyOpsResearchLabs · poc
https://github.com/RedyOpsResearchLabs/SEP-14.2-Arbitrary-Write

This repository contains a functional exploit for CVE-2020-5837, targeting Symantec Endpoint Protection (SEP) 14.2. The exploit leverages arbitrary write vulnerabilities via symbolic link manipulation, based on James Forshaw's symboliclink-testing-tools.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Symantec Endpoint Protection 14.2
No auth needed
Prerequisites: Local access to the target system · Symantec Endpoint Protection 14.2 installed
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (1)

Core 1

Scores

CVSS v3 7.8
EPSS 0.0075
EPSS Percentile 49.9%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-59
Status published
Products (1)
symantec/endpoint_protection < 14.3
Published May 11, 2020
Tracked Since Feb 18, 2026