Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2019-12042: Panda security products let attackers gain admin rights

CVE-2019-12042 · published 7 years ago

Summary

Panda Antivirus, Pro, Dome, Global Protection, Gold Protection and Internet Security create a shared memory object that anyone can write to. An attacker can send a specially crafted command that tricks the AgentSvc.exe service into running with higher privileges, potentially giving the attacker administrator control. Update to version 18.07.03 or later to close the gap.

What to do

Update pandasecurity panda_antivirus to version 18.07.03 or later.
Update pandasecurity panda_antivirus_pro to version 18.07.03 or later.
Update pandasecurity panda_dome to version 18.07.03 or later.
Update pandasecurity panda_global_protection to version 18.07.03 or later.
Update pandasecurity panda_gold_protection to version 18.07.03 or later.
Update pandasecurity panda_internet_security to version 18.07.03 or later.

Affected software

Vendor	Product	Affected versions
pandasecurity	panda_antivirus	< 18.07.03 `cpe:2.3:a:pandasecurity:panda_antivirus::::::::`
pandasecurity	panda_antivirus_pro	< 18.07.03 `cpe:2.3:a:pandasecurity:panda_antivirus_pro::::::::`
pandasecurity	panda_dome	< 18.07.03 `cpe:2.3:a:pandasecurity:panda_dome::::::::`
pandasecurity	panda_global_protection	< 18.07.03 `cpe:2.3:a:pandasecurity:panda_global_protection::::::::`
pandasecurity	panda_gold_protection	< 18.07.03 `cpe:2.3:a:pandasecurity:panda_gold_protection::::::::`
pandasecurity	panda_internet_security	< 18.07.03 `cpe:2.3:a:pandasecurity:panda_internet_security::::::::`

Original advisory text

Insecure permissions of the section object Global\PandaDevicesAgentSharedMemory and the event Global\PandaDevicesAgentSharedMemoryChange in Panda products before 18.07.03 allow attackers to queue an event (as an encrypted JSON string) to the system service AgentSvc.exe, which leads to privilege escalation when the CmdLineExecute event is queued. This affects Panda Antivirus, Panda Antivirus Pro, Panda Dome, Panda Global Protection, Panda Gold Protection, and Panda Internet Security.

References

https://github.com/SouhailHammou/Panda-Antivirus-LPE Exploit Third Party Advisory
https://rce4fun.blogspot.com/2019/05/panda-antivirus-local-privilege.html Exploit Third Party Advisory
https://www.pandasecurity.com/usa/support/card?id=100063 Vendor Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

9.8 Critical

Exploitation

3% chance of attack within 30 days

Type

CWE-732Incorrect Permission Assignment for Critical Resource

Timeline

Published23 May 2019

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2019-12042 · NVD

Track software like this

Free during beta