{"api_version":"1","generated_at":"2026-07-23T12:19:31+00:00","cve":"CVE-2020-7251","urls":{"html":"https://cve.report/CVE-2020-7251","api":"https://cve.report/api/cve/CVE-2020-7251.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2020-7251","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-7251"},"summary":{"title":"CVE-2020-7251","description":"Improper access control vulnerability in Configuration Tool in McAfee Mcafee Endpoint Security (ENS) Prior to 10.6.1 February 2020 Update allows local users to disable security features via unauthorised use of the configuration tool from older versions of ENS.","state":"PUBLIC","assigner":"psirt@mcafee.com","published_at":"2020-02-14 15:15:00","updated_at":"2023-11-07 03:25:00"},"problem_types":["CWE-863"],"metrics":[],"references":[{"url":"https://kc.mcafee.com/corporate/index?page=content&id=SB10299","name":"https://kc.mcafee.com/corporate/index?page=content&id=SB10299","refsource":"","tags":[],"title":"McAfee Security Bulletin - Endpoint Security for Windows update fixes two vulnerabilities (CVE-2019-3652 and CVE-2019-3653)","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7251","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7251","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2020","cve_id":"7251","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mcafee","cpe5":"endpoint_security","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"7251","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mcafee","cpe5":"endpoint_security","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"psirt@mcafee.com","ID":"CVE-2020-7251","STATE":"PUBLIC","TITLE":"ESConfig Tool able to edit configuration for newer version"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Mcafee Endpoint Security (ENS)","version":{"version_data":[{"version_affected":"<","version_name":"10.6.x","version_value":"10.6.1 February 2020 update"}]}}]},"vendor_name":"McAfee, LLC"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Improper access control vulnerability in Configuration Tool in McAfee Mcafee Endpoint Security (ENS) Prior to 10.6.1 February 2020 Update allows local users to disable security features via unauthorised use of the configuration tool from older versions of ENS."}]},"generator":{"engine":"Vulnogram 0.0.9"},"impact":{"cvss":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-358 Improperly Implemented Security Check for Standard"}]}]},"references":{"reference_data":[{"name":"https://kc.mcafee.com/corporate/index?page=content&id=SB10299","refsource":"CONFIRM","url":"https://kc.mcafee.com/corporate/index?page=content&id=SB10299"}]},"source":{"discovery":"INTERNAL"}},"nvd":{"publishedDate":"2020-02-14 15:15:00","lastModifiedDate":"2023-11-07 03:25:00","problem_types":["CWE-863"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM"},"exploitabilityScore":1.8,"impactScore":3.6},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:N/I:P/A:N","accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":2.1},"severity":"LOW","exploitabilityScore":3.9,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:mcafee:endpoint_security:*:*:*:*:*:*:*:*","versionEndExcluding":"10.6.1","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2020","CveId":"7251","Ordinal":"167530","Title":"CVE-2020-7251","CVE":"CVE-2020-7251","Year":"2020"},"notes":[{"CveYear":"2020","CveId":"7251","Ordinal":"1","NoteData":"Improper access control vulnerability in Configuration Tool in McAfee Mcafee Endpoint Security (ENS) Prior to 10.6.1 February 2020 Update allows local users to disable security features via unauthorised use of the configuration tool from older versions of ENS.","Type":"Description","Title":null},{"CveYear":"2020","CveId":"7251","Ordinal":"2","NoteData":"2020-02-14","Type":"Other","Title":"Published"},{"CveYear":"2020","CveId":"7251","Ordinal":"3","NoteData":"2020-02-14","Type":"Other","Title":"Modified"}]}}}