Vulnerability · Published Oct 14, 2020 · Assigned by cisco

CVE-2020-3427Duo Authentication for Windows Logon and RDP Privilege Escalation Vulnerability

Medium 6.6

In plain English

A medium-severity security flaw in Duo Authentication for Windows Logon and RDP from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 3.1)6.6Medium

Exploit odds (30 days)0.3%top 76.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Windows Logon installer prior to 4.1.2 did not properly validate file installation paths. This allows an attacker with local user privileges to coerce the installer to write to arbitrary privileged directories. If successful, an attacker can manipulate files used by Windows Logon, cause Denial of Service (DoS) by deleting file(s), or replace system files to potentially achieve elevation of privileges. Note that this can only exploitable during new installations while the installer is running and is not exploitable once installation is finished. Versions 4.1.2 of Windows Logon addresses this issue.

Affected products (as reported)

Vendor	Product	Versions
Cisco	Duo Authentication for Windows Logon and RDP	unspecified – before 4.1.2

Weakness: CWE-280 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

References

Duo Authentication for Windows Logon and RDP Privilege Escalation Vulnerability vendor-advisory, x_refsource_CISCO