Palo Alto Networks Security Advisories / CVE-2020-1984

CVE-2020-1984 Secdo: Privilege escalation via hardcoded script path

Severity 7.8 · HIGH
Attack Vector LOCAL
Attack Complexity LOW
Confidentiality Impact HIGH
Privileges Required LOW
Integrity Impact HIGH
User Interaction NONE
Availability Impact HIGH


Secdo tries to execute a script at a hardcoded path if present, which allows a local authenticated user with 'create folders or append data' access to the root of the OS disk (C:\) to gain system privileges if the path does not already exist or is writable. This issue affects all versions of Secdo for Windows.

Product Status

Secdo all versions on Windows


CVSSv3.1 Base Score:7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness Type

CWE-73 External Control of File Name or Path


This product is no longer supported and the issue is not going to be fixed. The issue can be completely mitigated by ensuring that unprivileged users do not have 'create folder' access on the root of the filesystem such as C:\ or on a folder named C:\Common.

Workarounds and Mitigations

This issue can be mitigated by :

- Ensure unprivileged users do not have 'create folder' access on the root of filesystem such as C:\.


- Creating a folder named C:\Common and ensuring unprivileged users do not have 'create folder' access.


We like to thank Eviatar Gerzi of CyberArk Labs Team for discovering and reporting this issue.


Initial publication
© 2023 Palo Alto Networks, Inc. All rights reserved.