CVE-2021-1386: Cisco Advanced Malware Protection for Endpoints Windows Connector, ClamAV for Windows, and Immunet DLL Hijacking Vulnerability
First published: Thu Apr 08 2021(Updated: )
A vulnerability in the dynamic link library (DLL) loading mechanism in Cisco Advanced Malware Protection (AMP) for Endpoints Windows Connector, ClamAV for Windows, and Immunet could allow an authenticated, local attacker to perform a DLL hijacking attack on an affected Windows system. To exploit this vulnerability, the attacker would need valid credentials on the system. The vulnerability is due to insufficient validation of directory search paths at run time. An attacker could exploit this vulnerability by placing a malicious DLL file on an affected system. A successful exploit could allow the attacker to execute arbitrary code with SYSTEM privileges.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Advanced Malware Protection For Endpoints | <7.3.15 | |
| Cisco Clamav | <0.103.2 | |
| Cisco Immunet | <7.4.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-1386?
CVE-2021-1386 is a vulnerability in the dynamic link library (DLL) loading mechanism in Cisco Advanced Malware Protection (AMP) for Endpoints Windows Connector, ClamAV for Windows, and Immunet.
How does CVE-2021-1386 affect Cisco Advanced Malware Protection for Endpoints?
CVE-2021-1386 affects Cisco Advanced Malware Protection for Endpoints version up to 7.3.15.
How does CVE-2021-1386 affect Cisco ClamAV?
CVE-2021-1386 affects Cisco ClamAV version up to 0.103.2.
How does CVE-2021-1386 affect Cisco Immunet?
CVE-2021-1386 affects Cisco Immunet version up to 7.4.0.
What is the severity of CVE-2021-1386?
CVE-2021-1386 has a severity score of 7.8 (high).
How can an attacker exploit CVE-2021-1386?
An authenticated, local attacker can exploit CVE-2021-1386 to perform a DLL hijacking attack on an affected Windows system.
Is there a fix available for CVE-2021-1386?
Yes, Cisco has released a security advisory with mitigation measures for CVE-2021-1386. Please refer to the official Cisco Security Advisory for more information.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/weakness
- agent/title
- agent/last-modified-date
- agent/severity
- agent/tags
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- vendor/cisco
- canonical/cisco advanced malware protection for endpoints
- canonical/cisco clamav
- canonical/cisco immunet