Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2008-5121 — Citrix Deterministic Network Enhancer vulnerability

CWE-2645 documents4 sources
Severity
7.2HIGHNVD
EPSS
0.4%
top 42.48%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
8
Citrix Deterministic Network EnhancerCitrix ADMCitrix Hypervisor+5 more
Timeline
PublishedNov 18
Latest updateMay 17

Description

dne2000.sys in Citrix Deterministic Network Enhancer (DNE) 2.21.7.233 through 3.21.7.17464, as used in (1) Cisco VPN Client, (2) Blue Coat WinProxy, and (3) SafeNet SoftRemote and HighAssurance Remote, allows local users to gain privileges via a crafted DNE_IOCTL DeviceIoControl request to the \\.\DNE device interface.

CVSS vector

AV:L/AC:L/C:C/I:C/A:CExploitability: 3.9 | Impact: 10.0

Affected Packages8 packages

▶NVDcitrix/deterministic_network_enhancer2.21.7.223, 3.21.7.17464+1

🔴Vulnerability Details

1
GHSA
GHSA-928c-9c6q-76w6: dne2000↗2022-05-17
▶

💥Exploits & PoCs

1
Exploit-DB
Deterministic Network Enhancer - 'dne2000.sys' Kernel Ring0 SYSTEM↗2008-06-17
▶

📋Vendor Advisories

2
Citrix
CVE-2008-5121: dne2000.sys in Citrix Deterministic Network Enhancer (DNE) 2.21.7.233 through 3.21.7.17464, as used in (1) Cisco VPN Client, (2) Blue Coat WinProxy, a↗2008-11-18
▶
Citrix
Citrix Security Bulletin CTX117751↗
▶