How serious is CVE-2021-31854?

This vulnerability has a CVSS score of 7.8 out of 10, classified as HIGH severity. Proof-of-concept exploit code is publicly available, making this an active threat.

Is there exploit code available for CVE-2021-31854?

Yes, proof-of-concept exploit code for CVE-2021-31854 is publicly available on GitHub and security research platforms. This increases the risk of active exploitation.

Which products are affected by CVE-2021-31854?

CVE-2021-31854 affects mcafee agent. Check the full CVE details for specific version information.

How do I fix CVE-2021-31854?

To remediate CVE-2021-31854, check for security patches from mcafee. Apply all available updates and security patches. If no patch is available, implement recommended workarounds or security controls to mitigate the risk.

CVE-2021-31854

High

|7.8

Exploit Available

Plain English Summary

AI-powered analysis for quick understanding

This vulnerability allows an attacker to run their own commands on a Windows system by tricking McAfee Agent into executing a malicious file. To exploit it, the attacker needs local access to the machine and must place a specially crafted file in the right folder, which can then lead to gaining higher privileges on the system.

Technical Description

A command Injection Vulnerability in McAfee Agent (MA) for Windows prior to 5.7.5 allows local users to inject arbitrary shell code into the file cleanup.exe. The malicious clean.exe file is placed into the relevant folder and executed by running the McAfee Agent deployment feature located in the System Tree. An attacker may exploit the vulnerability to obtain a reverse shell which can lead to privilege escalation to obtain root privileges.

CVSS Vector Analysis

Attack VectorLocal

Attack ComplexityLow

Privileges RequiredNone

User InteractionRequired

Confidentiality ImpactHigh

Integrity ImpactHigh

Availability ImpactHigh

ScopeUnchanged

Vector String

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploit Resources

Search for proof-of-concept code and exploit modules

GitHub Search Exploit-DB Nuclei Templates Metasploit Vulners

Official References

NIST NVD

Est. Bounty

$2,684($1K-$5K)

Vendor Response

Grade FPatched in 1497 days

Quick Information

Published

Jan 19, 2022

about 4 years ago

Last Modified

Feb 24, 2026

about 1 month ago

Vendor

mcafee

Product

agent

Related Vulnerabilities

CVE-2023-45243Medium

This vulnerability allows an attacker to access sensitive information from Acronis Cyber Protect products without proper authorization. It affects versions prior to specific builds, meaning that if your software isn't updated, an attacker could potentially view confidential data on your system.

CVE-2023-45242Medium

This vulnerability allows an attacker to access sensitive information from Acronis Cyber Protect products due to a lack of proper authorization controls. It affects versions prior to specific builds, meaning that if your software is outdated, an attacker could exploit this flaw to retrieve confidential data without permission.

CVE-2023-44210Medium

This vulnerability allows an attacker to access and manipulate sensitive information in Acronis Cyber Protect products due to a lack of proper authorization checks. It affects users running outdated versions of the software on Linux, macOS, or Windows, meaning that if your system isn't updated, it could be at risk.

CVE-2023-44209High

This vulnerability allows an attacker with local access to a system to gain higher privileges than they should have, potentially letting them control the system or access sensitive data. It affects specific versions of Acronis Cyber Protect products before certain builds, meaning attackers need to be able to log into the system first to exploit it.

CVE-2021-31843High

This vulnerability allows a local user to access sensitive files in McAfee Endpoint Security that they shouldn't normally be able to reach by tricking the software into redirecting its file operations. To exploit this, the attacker needs to manipulate junction links on the system, which requires some level of access to the local machine.