Palo Alto Networks Security Advisories / CVE-2020-1986

CVE-2020-1986 Secdo: Local authenticated users can cause Windows system crash

Severity 5.5 · MEDIUM
Attack Vector LOCAL
Attack Complexity LOW
Confidentiality Impact NONE
Privileges Required LOW
Integrity Impact NONE
User Interaction NONE
Availability Impact HIGH


Improper input validation vulnerability in Secdo allows an authenticated local user with 'create folders or append data' access to the root of the OS disk (C:\) to cause a system crash on every login. This issue affects all versions Secdo for Windows.

Product Status

Secdo all versions on Windows


CVSSv3.1 Base Score:5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness Type

CWE-20 Improper Input Validation


This product is no longer supported and the issue will not be fixed. This issue can be easily mitigated by creating a "C:\proc" folder and not allowing unprivileged users to access to that folder, or ensuring unprivileged users do not have 'create folder' access to the root of a disk (C:\).

Workarounds and Mitigations

Exploitation of this issue can be prevented by creating a "C:\proc" folder and not allowing unprivileged users to access that folder.


We like to thank Eviatar Gerzi of CyberArk Labs Team for discovering and reporting this issue.


Initial publication
© 2023 Palo Alto Networks, Inc. All rights reserved.