CVE-2020-7276mediumCWE-287

CVE-2020-7276: medium-severity vulnerability in McAfee Endpoint Security (ENS)

Unrestricted Policy Management using MfeUpgradeTool.exe

Published · Updated

Follow this CVE+ Monitor McAfee Endpoint Security

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.4epss 0.3%
Authentication bypass vulnerability in MfeUpgradeTool in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 April 2020 Update allows administrator users to access policy settings via running this tool.
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:H/A:L
Affected products
McAfee LLC · McAfee Endpoint Security (ENS)
Related CVEs — McAfee Endpoint Security (ENS)

In the same product, most dangerous first.

CVE-2020-7278HIGHMcAfee firewall rules not enforced correctlyEPSS 0.6%CVE-2020-7250HIGHENS symbolic link log file manipulation vulnerabilityEPSS 0.4%CVE-2020-7275MEDIUMUnquoted service paths for some McAfee ENS filesEPSS 0.3%CVE-2020-7277MEDIUMMcAfee processes not protectedEPSS 0.3%CVE-2020-7261MEDIUMBuffer overwrite in ENS allowed to bypass AMSI protectionEPSS 0.3%CVE-2020-7257HIGHPrivilege Escalation vulnerability through Symbolic links in ENSEPSS 0.3%