CVE-2020-5855

CWE-863 — Incorrect Authorization4 documents4 sources
Severity
4.3MEDIUM
EPSS
0.1%
top 64.45%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
F5 Big-ip Access Policy ManagerF5 Big-ip Access Policy Manager ClientF5 Edge Client FOR Windows
Timeline
PublishedFeb 6
Latest updateMay 24

Description

When the Windows Logon Integration feature is configured for all versions of BIG-IP Edge Client for Windows, unauthorized users who have physical access to an authorized user's machine can get shell access under unprivileged user.

CVSS vector

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LExploitability: 0.9 | Impact: 3.4

Affected Packages3 packages

▶NVDf5/big-ip_access_policy_manager11.5.2 — 11.6.5+4

🔴Vulnerability Details

2
GHSA
GHSA-pr8j-wgf3-mgrx: When the Windows Logon Integration feature is configured for all versions of BIG-IP Edge Client for Windows, unauthorized users who have physical acce↗2022-05-24
▶
CVEList
CVE-2020-5855: When the Windows Logon Integration feature is configured for all versions of BIG-IP Edge Client for Windows, unauthorized users who have physical acce↗2020-02-06
▶

📋Vendor Advisories

1
F5
CVE-2020-5855: When the Windows Logon Integration feature is configured for all versions of BIG-IP Edge Client for Windows, unauthor...↗2020-02-06
▶
CVE-2020-5855 (MEDIUM CVSS 4.3) | When the Windows Logon Integration | cvebase.io