Vulnerability · Published Oct 17, 2022 · Assigned by NLOK
CVE-2022-3368Software Updater of Avira Security for Windows vulnerable to Privilege Escalation
High 7.3
In plain English
A high-severity incorrect default permissions in "Avira Security" – for Windows from Nortonlifelock. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS 3.1)7.3High
Exploit odds (30 days)1.1%top 34.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
A vulnerability within the Software Updater functionality of Avira Security for Windows allowed an attacker with write access to the filesystem, to escalate his privileges in certain scenarios. The issue was fixed with Avira Security version 1.1.72.30556.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Nortonlifelock | "Avira Security" – for Windows | all – before 1.1.71.30554 |
Weakness: CWE-276 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H