CVE-2021-31838
Plain English Summary
AI-powered analysis for quick understanding
This vulnerability allows an authenticated administrator of MVISION EDR to execute any command on the system using PowerShell, which could lead to unauthorized access or control over the system. The attacker must already have administrator access to exploit this flaw, making it critical for organizations to secure their admin accounts.
Technical Description
A command injection vulnerability in MVISION EDR (MVEDR) prior to 3.4.0 allows an authenticated MVEDR administrator to trigger the EDR client to execute arbitrary commands through PowerShell using the EDR functionality 'execute reaction'.
CVSS Vector Analysis
Vector String
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HExploit Resources
Search for proof-of-concept code and exploit modules
Official References
Quick Information
Published
Jun 29, 2021
almost 5 years ago
Last Modified
Feb 24, 2026
about 1 month ago
Vendor
mcafee
Product
mvision edr
Related Vulnerabilities
This vulnerability allows an attacker to run their own commands on a Windows system by tricking McAfee Agent into executing a malicious file. To exploit it, the attacker needs local access to the machine and must place a specially crafted file in the right folder, which can then lead to gaining higher privileges on the system.
This vulnerability allows a local user to access sensitive files in McAfee Endpoint Security that they shouldn't normally be able to reach by tricking the software into redirecting its file operations. To exploit this, the attacker needs to manipulate junction links on the system, which requires some level of access to the local machine.
This vulnerability allows a local user to gain administrator privileges on a system running McAfee's Endpoint Security for Linux, enabling them to execute any code they want. It occurs during the installation process due to a timing issue that lets the attacker exploit temporary files that are not securely managed.