High severity7.5NVD Advisory· Published Mar 13, 2019· Updated Jun 17, 2026
CVE-2019-9742
CVE-2019-9742
Description
gdwfpcd.sys in G Data Total Security before 2019-02-22 allows an attacker to bypass ACLs because Interpreted Device Characteristics lacks FILE_DEVICE_SECURE_OPEN and therefore files and directories "inside" the \\.\gdwfpcd device are not properly protected, leading to unintended impersonation or object creation.
Affected products
2cpe:2.3:a:gdata-software:total_security:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:gdata-software:total_security:*:*:*:*:*:*:*:*range: <2019-02-22
- (no CPE)range: <2019-02-22
Patches
Vulnerability mechanics
References
2- github.com/nafiez/nafiez.github.io/blob/master/_posts/2019-03-13-gdata-total-security-acl-bypass.mdnvdExploitThird Party Advisory
- nafiez.github.io/security/bypass/2019/03/12/gdata-total-security-acl-bypass.htmlnvdExploitThird Party Advisory
News mentions
0No linked articles in our index yet.