CVE-2021-28098 - CVE House
Back to Database
Status published High CVE-2021-28098

An issue was discovered in Forescout CounterACT before 8.1.4. A...

Vulnerability Description

An issue was discovered in Forescout CounterACT before 8.1.4. A local privilege escalation vulnerability is present in the logging function. SecureConnector runs with administrative privileges and writes logs entries to a file in %PROGRAMDATA%\ForeScout SecureConnector\ that has full permissions for the Everyone group. Using a symbolic link allows an attacker to point the log file to a privileged location such as %WINDIR%\System32. The resulting log file adopts the file permissions of the source of the symbolic link (in this case, the Everyone group). The log file in System32 can be replaced and renamed with a malicious DLL for DLL hijacking.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-28098

Credits & Attribution

No credits recorded in the NVD database.

References

More from forescout

View All →
CVE-2012-4985
The Forescout CounterACT NAC device 6.3.4.1 does not block ARP...
Medium 4.3
CVE-2012-4983
Multiple cross-site scripting (XSS) vulnerabilities on the Forescout CounterACT NAC...
Medium 4.3
CVE-2012-4982
Open redirect vulnerability in assets/login on the Forescout CounterACT NAC...
Medium 5.8
CVE-2012-1825
Multiple cross-site scripting (XSS) vulnerabilities in the status program on...
Medium 4.3

Affected Vendor

Affected Software

counteract
Vulnerable Versions:
0

Timeline

Official Publish: April 14th, 2021
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.