CVE-2021-28098

An issue was discovered in Forescout CounterACT before 8.1.4. A local privilege escalation vulnerability is present in the logging function. SecureConnector runs with administrative privileges and writes logs entries to a file in %PROGRAMDATA%\ForeScout SecureConnector\ that has full permissions for the Everyone group. Using a symbolic link allows an attacker to point the log file to a privileged location such as %WINDIR%\System32. The resulting log file adopts the file permissions of the source of the symbolic link (in this case, the Everyone group). The log file in System32 can be replaced and renamed with a malicious DLL for DLL hijacking.

• CWE-59
• CWE-427
• CWE-732

• https://docs.forescout.comVendor Advisory
• https://jordanpotti.com/2021/03/30/forescout-priv-esc-folder-permissions/Exploit, Third Party Advisory
• https://www.adversis.io/research/2021/3/30/forescout-secure-connector-local-privilege-escalationExploit, Third Party Advisory
• https://docs.forescout.comVendor Advisory
• https://jordanpotti.com/2021/03/30/forescout-priv-esc-folder-permissions/Exploit, Third Party Advisory
• https://www.adversis.io/research/2021/3/30/forescout-secure-connector-local-privilege-escalationExploit, Third Party Advisory

Published

Apr 14, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-28091Lasso all versions prior to 2.7.0 has improper verification …7.5
• CVE-2021-28092The is-svg package 2.1.0 through 4.2.1 for Node.js uses a re…7.5
• CVE-2021-28093OX Documents before 7.10.5-rev5 has Incorrect Access Control…6.5
• CVE-2021-28094OX Documents before 7.10.5-rev7 has Incorrect Access Control…6.5
• CVE-2021-28095OX Documents before 7.10.5-rev5 has Incorrect Access Control…4.8
• CVE-2021-28096An issue was discovered in Stormshield SNS before 4.2.3 (whe…5.3
• CVE-2021-28099In Netflix OSS Hollow, since the Files.exists(parent) is run…4.4
• CVE-2021-28100Priam uses File.createTempFile, which gives the permissions …5.5
• CVE-2021-28109TranzWare (POI) FIMI before 4.2.20.4.2 allows login_tw.php r…6.1
• CVE-2021-28110/exec in TranzWare e-Commerce Payment Gateway (TWEC PG) befo…7.5
• CVE-2021-28111Draeger X-Dock Firmware before 03.00.13 has Hard-Coded Crede…8.8
• CVE-2021-28112Draeger X-Dock Firmware before 03.00.13 has Active Debug Cod…8.8