7.5high
CVE-2018-6700
True Key (TK) - DLL Search Order Hijacking vulnerability
Published 8 y ago · modified 4 mo ago · JSON
CVSS
7.5
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
0.9%
percentile 61%
Public exploits
0
none known
Summary
DLL Search Order Hijacking vulnerability in Microsoft Windows Client in McAfee True Key (TK) before 5.1.165 allows local users to execute arbitrary code via specially crafted malware.
Exploit prediction (EPSS)
0.94% probability of exploitation in the next 30 days, higher than 61% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.0 | 7.5 | CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H |
| NVD | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| CNA | 3.0 | 7.5 | CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Affected products
- McAfee True Key (TK)
Classification
- Weakness
- CWE-426 Untrusted Search Path
References
- service.mcafee.com /webcenter/portal/cp/home/articleview?articleId=TS102846 · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2018-6700
- NVD: CVE-2018-6700
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.