Skip to content
COOEY

EXPOSURES › CVE-2020-3950

CVE-2020-3950

HIGH ⌖ ON CISA KEV · EXPLOITED
DETAIL
SourceCISA-KEV · kev Published2021-11-03 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2020-3950 ↗
⌖ EXPLOITED IN THE WILD SHAME 78/100 exploited-in-wildprivilege-escalationunpatched

Improper use of setuid binaries in VMware Fusion, VMRC, and Horizon Client for Mac allowed privilege escalation to root.

Attackers could escalate privileges to root on affected VMware products by exploiting setuid binaries, enabling full system compromise. DIBs must patch these products immediately and restrict setuid usage, as this flaw was actively exploited in the wild.

Shame score — A known privilege escalation flaw in widely deployed virtualization software was actively exploited in the wild, indicating a failure to patch a critical vulnerability before it was weaponized.

▸ RECOMMENDED ACTION  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

PLAYERS IMPLICATED
VMware, Inc. · vendorMultiple Products · product
DESCRIPTION

VMware Fusion, Remote Console (VMRC) for Mac, and Horizon Client for Mac contain a privilege escalation vulnerability due to improper use of setuid binaries that allows attackers to escalate privileges to root.

SENTIMENT · TRUSTED SOURCES
synthesis severe-fallout -0.60
VMware's setuid vulnerability in Fusion/VMRC/Horizon Client for Mac was a critical privilege escalation flaw allowing root access, widely flagged as severe by NVD and security press, reflecting poorly
cooey ↗ severe-fallout -0.60
Critical setuid privilege escalation flaw in VMware Mac products allowing root access, widely condemned as a severe security oversight.
"VMware Fusion, Remote Console (VMRC) for Mac, and Horizon Client for Mac contain a privilege escalation vulnerability due to improper use of setuid binaries that allows attackers to escalate privileges to root."
AFFECTED FEDRAMP PRODUCTS · 2
PRODUCTSTATUS
VMware Government Services (VGS)
VMware, Inc.
 Authorized
Workspace ONE
VMware, Inc.
 Authorized