McAfee · McAfee Total Protection (MTP)

CVE-2021-23874

McAfee Total Protection (MTP) privilege escalation vulnerability

Exploited in attacks High 8.2 Attack chance: 1.0%

What it is

Arbitrary Process Execution vulnerability in McAfee Total Protection (MTP) prior to 16.0.30 allows a local user to gain elevated privileges and execute arbitrary code bypassing MTP self-defense.

CISA: McAfee Total Protection (MTP) contains an improper privilege management vulnerability that allows a local user to gain elevated privileges and execute code, bypassing MTP self-defense.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: November 17, 2021

Added to the CISA list: November 3, 2021
Published: February 10, 2021
Severity: High 8.2 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 1.0% in the top 36.6% of all known vulnerabilities
Weakness: CWE-284
More details: NVD · CVE.org · CISA

All references (1)

http://service.mcafee.com/FAQDocument.aspx?&id=TS103114

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.