CVE-2020-11520
Last modified
CVE-2020-11520 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. The SDDisk2k.sys driver of WinMagic SecureDoc v8.5 and earlier allows local users to write to arbitrary kernel memory addresses because the IOCTL dispatcher lacks pointer validation. Exploiting this vulnerability results in privileged code execution.. EPSS estimates a 0.42% chance of exploitation in the next 30 days.
Description
The SDDisk2k.sys driver of WinMagic SecureDoc v8.5 and earlier allows local users to write to arbitrary kernel memory addresses because the IOCTL dispatcher lacks pointer validation. Exploiting this vulnerability results in privileged code execution.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Winmagic | Securedoc | <= 8.5 |
References
- https://www.winmagic.com/support/release-notes/securedoc-v8-5-sr2-hf1Release Notes, Vendor Advisory
- https://www.winmagic.com/support/release-notes/securedoc-v8-5-sr2/Release Notes, Vendor Advisory
- https://www.winmagic.com/support/release-notes/securedoc-v8-5-sr2-hf1Release Notes, Vendor Advisory
- https://www.winmagic.com/support/release-notes/securedoc-v8-5-sr2/Release Notes, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-11520?
How severe is CVE-2020-11520?
How do I fix CVE-2020-11520?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-11514The Rank Math plugin through 1.0.40.2 for WordPress allows u…9.8
- CVE-2020-11515The Rank Math plugin through 1.0.40.2 for WordPress allows u…6.1
- CVE-2020-11516Stored XSS in the Contact Form 7 Datepicker plugin through 2…5.4
- CVE-2020-11518Zoho ManageEngine ADSelfService Plus before 5815 allows unau…9.8
- CVE-2020-11519The SDDisk2k.sys driver of WinMagic SecureDoc v8.5 and earli…7.8
- CVE-2020-1152<p>An elevation of privilege vulnerability exists when Windo…5.8
- CVE-2020-11521libfreerdp/codec/planar.c in FreeRDP version > 1.0 through 2…6.6
- CVE-2020-11522libfreerdp/gdi/gdi.c in FreeRDP > 1.0 through 2.0.0-rc4 has …6.5
- CVE-2020-11523libfreerdp/gdi/region.c in FreeRDP versions > 1.0 through 2.…6.6
- CVE-2020-11524libfreerdp/codec/interleaved.c in FreeRDP versions > 1.0 thr…6.6
- CVE-2020-11525libfreerdp/cache/bitmap.c in FreeRDP versions > 1.0 through …2.2
- CVE-2020-11526libfreerdp/core/update.c in FreeRDP versions > 1.1 through 2…2.2
Are you affected by CVE-2020-11520?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST