Vulnerability · Published Jan 5, 2021 · Assigned by talos

CVE-2020-13541

Critical 9.3

In plain English

A critical-severity incorrect default permissions in Win-911. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).

Severity (CVSS 3.0)9.3Critical

Exploit odds (30 days)0.6%top 49.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

An exploitable local privilege elevation vulnerability exists in the file system permissions of the Mobile-911 Server V2.5 install directory. Depending on the vector chosen, an attacker can overwrite the service executable and execute arbitrary code with System privileges or replace other files within the installation folder that could lead to local privilege escalation.

Affected products (as reported)

Vendor	Product	Versions
n/a	Win-911	Win-911 Mobile Server V2.5

Weakness: CWE-276 · Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

https://talosintelligence.com/vulnerability_reports/TALOS-2020-1151 x_refsource_MISC