title: ENS configuration can be edited by attacker with local administrator permissions
description: Improper access control vulnerability in ESconfigTool.exe in McAfee Endpoint Security (ENS) for Windows all current versions allows local administrator to alter ENS configuration up to and including disabling all protection offered by ENS via insecurely implemented encryption of configuration for export and import.
problem types: CWE-264 Permissions, Privileges, and Access Controls
affected:
{
product: Endpoint Security (ENS) for Window
vendor: McAfee, LLC
versions:
lessThanOrEqual: ENS 10.7.0 July 2020 Update, status: affected, version: 10.7.x, versionType: custom
lessThanOrEqual: ENS 10.6.1 July 2020 Update, status: affected, version: 10.6.x, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
version: 3.1
]