CVE-2019-9742: gdata-software total_security Missing Authorization
Vulnerability summary
CVE-2019-9742 is a high (CVSS 7.5) Missing Authorization vulnerability in gdata-software total_security. EPSS estimates a 1.38% chance of exploitation in the next 30 days, higher than 71.6% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 13-03-2019PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
gdwfpcd.sys in G Data Total Security before 2019-02-22 allows an attacker to bypass ACLs because Interpreted Device Characteristics lacks FILE_DEVICE_SECURE_OPEN and therefore files and directories "inside" the \\.\gdwfpcd device are not properly protected, leading to unintended impersonation or object creation.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
1.38%
Chance of exploitation in the next 30 days
Percentile
72%
Versus all other CVEs
30-day change
0.00 pp
From 1.38% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundNafiez.Github.Io
Maturity: poc
Exploit Reference (nafiez.github.io)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Gdata-software1 product
- total_security< 2019-02-22
1 vendor · 1 product
References
2 links- nafiez.github.io/security/bypass/2019/03/12/gdata-total-security-acl-bypass.htmlX Refsource MISCExploitThird Party Advisory
- github.com/nafiez/nafiez.github.io/blob/master/_posts/2019-03-13-gdata-total-security-acl-bypass.mdX Refsource MISCExploitThird Party Advisory