Sophos SafeGuard Enterprise before 8.00.5, SafeGuard Easy before 7.00.3, and SafeGuard LAN Crypt before 3.95.2 are vulnerable to Local…

Description

Sophos SafeGuard Enterprise before 8.00.5, SafeGuard Easy before 7.00.3, and SafeGuard LAN Crypt before 3.95.2 are vulnerable to Local Privilege Escalation via IOCTL 0x802022E0. By crafting an input buffer we can control the execution path to the point where the constant 0x12 will be written to a user-controlled address. We can take advantage of this condition to modify the SEP_TOKEN_PRIVILEGES structure of the Token object belonging to the exploit process and grant SE_DEBUG_NAME privilege. This allows the exploit process to interact with higher privileged processes running as SYSTEM and execute code in their security context.

Scores

EPSS (exploitation in 30 days)

0.61% · top 50% of all CVEs (4 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.

Weakness

• n/a
• CWE-119 (opens in a new tab)All about CWE-119 and its CVEs

Affected products

• n/a

  • affected n/a

References (3)

• https://community.sophos.com/kb/en-us/131934 (opens in a new tab)x_refsource_CONFIRMx_transferred
• 20180706 Sophos Safeguard Products - Multiple Privilege Escalation Vulnerabilities. (opens in a new tab)mailing-listx_refsource_FULLDISCx_transferred
• https://labs.nettitude.com/blog/cve-2018-6851-to-cve-2018-6857-sophos-privilege-escalation-vulnerabilities/ (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2018-6857](https://trackcve.app/badge/CVE-2018-6857.svg)](https://trackcve.app/cve/CVE-2018-6857)

Record last updated 5 Aug 2024, 06:17 UTC.