CVE-2021-23874
McAfee Total Protection (MTP) Improper Privilege Management Vulnerability
Description
CVE-2021-23874 is a high-severity improper privilege management vulnerability in McAfee Total Protection (MTP) prior to version 16.0.30 with a CVSS score of 8.2. The vulnerability allows a local user with low privileges to gain elevated privileges and execute arbitrary code by bypassing MTP's self-defense mechanisms. The flaw stems from incorrect permission assignments on critical resources, enabling attackers to manipulate the security product itself. Once exploited, an attacker can execute arbitrary processes with elevated privileges, effectively disabling or circumventing the endpoint protection. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| mcafee | total protection | < 16.0.30 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://service.mcafee.com/FAQDocument.aspx?&id=TS103114(Broken Link)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-23874(US Government Resource)
Weakness Type
CWE-269: Improper Privilege Management
CWE-269 occurs when a product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control. In CVE-2021-23874, McAfee Total Protection fails to adequately protect its own processes and resources from manipulation by lower-privileged local users, allowing privilege escalation that bypasses the product's self-defense capabilities.
Learn more: CWE-269 — Improper Privilege Management
CWE-732: Incorrect Permission Assignment for Critical Resource
CWE-732 describes situations where a product specifies permissions for a security-critical resource in a way that allows unintended actors to access or modify it. In this vulnerability, critical MTP resources are assigned permissions that allow low-privileged users to interact with them in ways that enable arbitrary process execution.
Learn more: CWE-732 — Incorrect Permission Assignment for Critical Resource
Impact Analysis
The impact of CVE-2021-23874 is rated High with a CVSS score of 8.2 and the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. While exploitation requires local access with low privileges and some user interaction, the scope is changed, meaning the attacker can impact resources beyond the vulnerable component. All three impact dimensions are rated High. A successful exploit allows the attacker to execute arbitrary code with elevated privileges, effectively taking control of the endpoint protection software. This is particularly dangerous because it not only grants elevated access to the system but also neutralizes the security product that would normally detect and prevent malicious activity, creating a blind spot for defenders.
Exploit Maturity
CVE-2021-23874 is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, added on November 3, 2021, confirming active exploitation in the wild. The EPSS score of 0.009 (74.7th percentile) indicates moderate exploitation probability, reflecting the local access requirement which limits the attack surface compared to network-exploitable vulnerabilities. However, the presence in the KEV catalog confirms that threat actors have successfully used this vulnerability in real-world attacks, likely as part of post-compromise privilege escalation chains.
Remediation
- Update McAfee Total Protection to version 16.0.30 or later immediately, as this version contains the official patch that addresses the privilege management vulnerability.
- Enable automatic updates for McAfee Total Protection on all endpoints to ensure that security patches are applied promptly when released.
- Restrict local user accounts by applying the principle of least privilege across all systems, minimizing the number of users with local access who could potentially exploit this vulnerability.
- Monitor for suspicious process execution using endpoint detection and response (EDR) tools to detect attempts to manipulate McAfee Total Protection processes or bypass its self-defense mechanisms.
- Audit endpoint security configurations to verify that MTP's tamper protection and self-defense features are properly enabled and functioning after the update.
- Investigate potentially compromised systems where the vulnerable version was installed, looking for signs of privilege escalation, unauthorized process execution, or disabled security controls.
Technical Details
The vulnerability resides in McAfee Total Protection's process and resource protection mechanisms. MTP includes self-defense features designed to prevent unauthorized modification or termination of its processes and files. However, prior to version 16.0.30, these protections contained a flaw in how permissions were assigned to critical resources. A local user with low-level privileges could interact with certain MTP components in unintended ways, manipulating the security product's own execution environment. This allowed the attacker to execute arbitrary processes within the context of the elevated MTP service, effectively using the security product as a privilege escalation vector. The attack requires local access (AV:L) and low privileges (PR:L), with some user interaction needed (UI:R). The changed scope (S:C) indicates that the attacker can leverage the MTP service context to impact the broader system beyond the vulnerable component itself. The CVSS vector reflects the local nature of the attack while acknowledging its significant impact when successfully exploited.
Frequently Asked Questions
Is CVE-2021-23874 being actively exploited?
Yes. CVE-2021-23874 is listed in CISA's Known Exploited Vulnerabilities catalog, confirming that it has been actively exploited in real-world attacks. The vulnerability is typically used as part of post-compromise privilege escalation, where an attacker who already has local access leverages the flaw to gain elevated privileges.
What products are affected by CVE-2021-23874?
McAfee Total Protection (MTP) versions prior to 16.0.30 are affected. The vulnerability specifically impacts the self-defense mechanism of the product, allowing local privilege escalation and arbitrary code execution.
How do I fix CVE-2021-23874?
Update McAfee Total Protection to version 16.0.30 or later. Ensure automatic updates are enabled for all endpoint installations. After updating, verify that MTP's tamper protection and self-defense features are functioning correctly.
How severe is CVE-2021-23874?
With a CVSS score of 8.2 (High), CVE-2021-23874 is a significant vulnerability. Although it requires local access, it allows privilege escalation that bypasses the security product's self-defense, effectively turning the endpoint protection into an attack vector. The changed scope means the impact extends beyond the vulnerable component.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.