CVE-2021-26738: Privilege Escalation for ZCC macOS via PATH Variable

Privilege Escalation for ZCC macOS via PATH Variable

Status

Published

2023-10-23

Updated

2025-02-27

Assigning organization

Zscaler

Description

Zscaler Client Connector for macOS prior to 3.7 had an unquoted search path vulnerability via the PATH variable. A local adversary may be able to execute code with root privileges.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Zscaler Client Connector

Default version status: unaffected

0 to < 3.7affected

References

https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022?applicable_category=macOS&applicable_version=3.7&deployment_date=2022-08-19&id=1414851 ↗