CVE-2020-15368 (ASRock Driver Elevation) Vulnerability: Analysis & Mitigation
A critical flaw (CVE-2020-15368) has been disclosed in ASRock Driver Elevation.
A critical flaw (CVE-2020-15368) has been disclosed in ASRock Driver Elevation.
This requires local or already-authenticated access to reach.
Anyone running ASRock Driver Elevation of the "RWEverything" tool, but with weak encryption that was easily bypassed is exposed, specifically wherever ASRock Driver Elevation is actually deployed rather than just licensed or installed somewhere unused.
What an attacker actually gains: successful exploitation allows the attacker to execute code with the permissions of the affected process.
This is tracked as CVE-2020-15368 and rated critical severity, which is the identifier to use when checking vendor guidance.
The affected versions are of the "RWEverything" tool, but with weak encryption that was easily bypassed, so that's the range to check against your own deployment.
Confirm whether ASRock Driver Elevation of the "RWEverything" tool, but with weak encryption that was easily bypassed is present anywhere in your asset and software inventory.
No exploitation has been reported yet, but that status can change, so keep watching vendor guidance while you remediate.
What happened
A critical flaw (CVE-2020-15368) has been disclosed in ASRock Driver Elevation.
This requires local or already-authenticated access to reach.
Who is affected
Anyone running ASRock Driver Elevation of the "RWEverything" tool, but with weak encryption that was easily bypassed is exposed, specifically wherever ASRock Driver Elevation is actually deployed rather than just licensed or installed somewhere unused.
Why it matters
What an attacker actually gains: successful exploitation allows the attacker to execute code with the permissions of the affected process.
Technical details
This is tracked as CVE-2020-15368 and rated critical severity, which is the identifier to use when checking vendor guidance.
The affected versions are of the "RWEverything" tool, but with weak encryption that was easily bypassed, so that's the range to check against your own deployment.
What security teams should do
Confirm whether ASRock Driver Elevation of the "RWEverything" tool, but with weak encryption that was easily bypassed is present anywhere in your asset and software inventory.
No exploitation has been reported yet, but that status can change, so keep watching vendor guidance while you remediate.