CVE-2020-17365

7.8 highEPSS 0.4%

High (7.8) in pango hotspot shield. EPSS 0.4% chance of exploitation in the next 30 days.

Improper directory permissions in the Hotspot Shield VPN client software for Windows 10.3.0 and earlier may allow an authorized user to potentially enable escalation of privilege via local access. The vulnerability allows a local user to corrupt system files: a local user can create a specially crafted symbolic link to a critical file on the system and overwrite it with privileges of the application.

Severity

CVSS 3.1

7.8 high

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 31% of CVEs (scores of 2026-10-31)
CWEs: CWE-59, CWE-732
Published: 2020-09-24
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

pango:hotspot_shield

References

https://cymptom.com/cve-2020-17365-hotspot-shield-vpn-new-privilege-escalation-vulnerability/2020/10/
https://www.pango.co/sec31944/
https://cymptom.com/cve-2020-17365-hotspot-shield-vpn-new-privilege-escalation-vulnerability/2020/10/
https://www.pango.co/sec31944/

Check your stack JSON