Riskcovery

CVE-2020-26200

State
Published
Severity
Not scored
Published
Feb 26, 2021
Updated
Aug 4, 2024
Reserved
Sep 30, 2020

Read the record on cve.org

Description

A component of Kaspersky custom boot loader allowed loading of untrusted UEFI modules due to insufficient check of their authenticity. This component is incorporated in Kaspersky Rescue Disk (KRD) and was trusted by the Authentication Agent of Full Disk Encryption in Kaspersky Endpoint Security (KES). This issue allowed to bypass the UEFI Secure Boot security feature. An attacker would need physical access to the computer to exploit it. Otherwise, local administrator privileges would be required to modify the boot loader component.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
Kaspersky Rescue Disk VersionN/A
  • All versions prior to 18.0.11.3 (patch C)Affected
Kaspersky Endpoint Security with the Full Disk Encryption component installedN/A
  • 10 SP2 MR2Affected
  • 10 SP2 MR3Affected
  • 11.0.0Affected
  • 11.0.1Affected
  • 11.1.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.