CVE-2019-12042 - CVE House

Back to Database

Status published Critical CVE-2019-12042

Insecure permissions of the section object Global\PandaDevicesAgentSharedMemory and the event...

9.8 CVSS

Vulnerability Description

Insecure permissions of the section object Global\PandaDevicesAgentSharedMemory and the event Global\PandaDevicesAgentSharedMemoryChange in Panda products before 18.07.03 allow attackers to queue an event (as an encrypted JSON string) to the system service AgentSvc.exe, which leads to privilege escalation when the CmdLineExecute event is queued. This affects Panda Antivirus, Panda Antivirus Pro, Panda Dome, Panda Global Protection, Panda Gold Protection, and Panda Internet Security.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-12042

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from pandasecurity

View All →

DLL hijacking in Panda Agent <=1.16.11 in Panda Security, S.L.U....

Panda Global Protection 17.0.1 allows local users to gain privileges...

Unquoted Windows search path vulnerability in the panda_url_filtering service in...

Panda Global Protection 17.0.1 allows a system crash via a...

Panda Global Protection 17.0.1 allows a system crash via a...

Affected Vendor

pandasecurity

View all reports →

Affected Software

panda antivirus, panda antivirus pro, panda dome, panda global protection, panda gold protection, panda internet security

Vulnerable Versions:

0

Timeline

Official Publish: May 23rd, 2019

Last Modified: August 4th, 2024

Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.