8.6high
CVE-2020-5145
SonicWall Global VPN client version 4.10.4.0314 and earlier have an insecure library loading (DLL hijacking) vulnerability.
Published 6 y ago · modified 4 mo ago · JSON
CVSS
8.6
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
1.2%
percentile 69%
Public exploits
0
none known
Summary
SonicWall Global VPN client version 4.10.4.0314 and earlier have an insecure library loading (DLL hijacking) vulnerability. Successful exploitation could lead to remote code execution in the target system.
Exploit prediction (EPSS)
1.24% probability of exploitation in the next 30 days, higher than 69% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 8.6 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
| NVD | 2.0 | 6.9 | AV:L/AC:M/Au:N/C:C/I:C/A:C |
Affected products
- SonicWall SonicWall Global VPN Client
Classification
- Weakness
- CWE-427 Uncontrolled Search Path Element
References
- psirt.global.sonicwall.com /vuln-detail/SNWLID-2020-0021 · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2020-5145
- NVD: CVE-2020-5145
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.