CVE-2022-0166 - CVE House
Back to Database
Status published High CVE-2022-0166

Privilege escalation vulnerability in McAfee Agent

Vulnerability Description

A privilege escalation vulnerability in the McAfee Agent prior to 5.7.5. McAfee Agent uses openssl.cnf during the build process to specify the OPENSSLDIR variable as a subdirectory within the installation directory. A low privilege user could have created subdirectories and executed arbitrary code with SYSTEM privileges by creating the appropriate pathway to the specifically created malicious openssl.cnf file.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-0166

Credits & Attribution

No credits recorded in the NVD database.

References

More from McAfee,LLC

View All →
CVE-2022-1824
McAfee MCPR privilege escalation
High 7.9
CVE-2022-1823
McAfee MCPR privilege escalation
High 7.9
CVE-2022-1258
SQL injection vulnerability in McAfee Agent's ePO extension
High 8.4
CVE-2022-1257
Improper Verification of Cryptographic Signature by McAfee Agent
Medium 6.1
CVE-2022-1256
Improper Privilege Management in McAfee Agent for Windows
High 7.8

Affected Vendor

Affected Software

McAfee Agent for Windows
Vulnerable Versions:
unspecified

Timeline

Official Publish: January 19th, 2022
Last Modified: August 2nd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.