CVSS 3.0
7.5 highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NCVE-2019-9742
High (7.5) in gdata-software total security. EPSS 1.4% chance of exploitation in the next 30 days.
gdwfpcd.sys in G Data Total Security before 2019-02-22 allows an attacker to bypass ACLs because Interpreted Device Characteristics lacks FILE_DEVICE_SECURE_OPEN and therefore files and directories "inside" the \\.\gdwfpcd device are not properly protected, leading to unintended impersonation or object creation.
Severity
- EPSS
- 1.4% chance of exploitation in the next 30 days; higher than 72% of CVEs (scores of 2026-11-01)
- CWE
- CWE-862
- Published
- Modified
- Record from
- the NVD, synced
Affected
- gdata-software:total_security
References
- https://github.com/nafiez/nafiez.github.io/blob/master/_posts/2019-03-13-gdata-total-security-acl-bypass.md
- https://nafiez.github.io/security/bypass/2019/03/12/gdata-total-security-acl-bypass.html
- https://github.com/nafiez/nafiez.github.io/blob/master/_posts/2019-03-13-gdata-total-security-acl-bypass.md
- https://nafiez.github.io/security/bypass/2019/03/12/gdata-total-security-acl-bypass.html