CVE-2020-17365 json
Improper directory permissions in the Hotspot Shield VPN client software for Windows 10.3.0 and earlier may allow an authorized user to pot…
published 2020-09-24 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-9319
- cvss
- 7.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 32%
- public exploits
- 0
- none known
Summary
Improper directory permissions in the Hotspot Shield VPN client software for Windows 10.3.0 and earlier may allow an authorized user to potentially enable escalation of privilege via local access. The vulnerability allows a local user to corrupt system files: a local user can create a specially crafted symbolic link to a critical file on the system and overwrite it with privileges of the application.
Exploit prediction
0.38% chance of exploitation in the next 30 days, higher than 32% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Classification
References
-
pango.co
/sec31944/
vendor-advisory
-
cymptom.com
/cve-2020-17365-hotspot-shield-vpn-new-privilege-escalation-vulnerability/2020/10/
third-party-advisory
Sources
- CVE List CVE-2020-17365
- NVD CVE-2020-17365
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.