CVE-2020-9332

Description

A vulnerable bus driver in FabulaTech “USB for Remote Desktop” and “USB over Network” allows low privileged users to add a fully controlled software USB device, which could be used by an attacker to elevate privileges under certain common circumstances

---

[Vulnerability Type]

Incorrect Access Control

---

[Vendor of Product]

FabulaTech

---

[Affected Product Code Base]

USB for Remote Desktop

USB over Network

---

[Attack Type]

Local

---

[Impact Escalation of Privileges]

true

---

[CVE Impact Other]

Adding trusted software USB HID device fully controlled by non-privileged users

---

[Discoverer]

Michael Myngerbayev of SentinelOne

---

[Reference]

https://www.fabulatech.com

https://labs.sentinelone.com/click-from-the-backyard-cve-2020-9332/