{"id":"CVE-2020-7251","aliases":["EUVD-2020-28378","GHSA-5qr7-8ch4-q94w"],"status":"published","title":"ESConfig Tool able to edit configuration for newer version","description":"Improper access control vulnerability in Configuration Tool in McAfee Mcafee Endpoint Security (ENS) Prior to 10.6.1 February 2020 Update allows local users to disable security features via unauthorised use of the configuration tool from older versions of ENS.","severity":{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00215,"percentile":0.12014,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-358","CWE-863"],"published":"2020-02-14T14:50:14Z","modified":"2026-06-17T03:24:35Z","products":[{"vendor":"mcafee","product":"endpoint_security"},{"vendor":"mcafee, llc","product":"mcafee endpoint security (ens)"}],"references":[{"url":"https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10299","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7251"},{"url":"https://github.com/advisories/GHSA-5qr7-8ch4-q94w"}],"sources":{"cve":[{"id":"CVE-2020-7251","title":"ESConfig Tool able to edit configuration for newer version","description":"Improper access control vulnerability in Configuration Tool in McAfee Mcafee Endpoint Security (ENS) Prior to 10.6.1 February 2020 Update allows local users to disable security features via unauthorised use of the configuration tool from older versions of ENS.","status":"published","published":"2020-02-14T14:50:14Z","modified":"2024-08-04T09:25:48.459Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-358"],"updated_at":"2026-11-02T14:35:58.331892Z"}],"euvd":[{"id":"EUVD-2020-28378","description":"Improper access control vulnerability in Configuration Tool in McAfee Mcafee Endpoint Security (ENS) Prior to 10.6.1 February 2020 Update allows local users to disable security features via unauthorised use of the configuration tool from older versions of ENS.","status":"published","published":"2020-02-14T14:50:14Z","modified":"2024-08-04T09:25:48Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T03:08:00.054795Z"}],"ghsa":[{"id":"GHSA-5qr7-8ch4-q94w","title":"Improper access control vulnerability in Configuration Tool in McAfee Mcafee Endpoint Security ...","description":"Improper access control vulnerability in Configuration Tool in McAfee Mcafee Endpoint Security (ENS) Prior to 10.6.1 February 2020 Update allows local users to disable security features via unauthorised use of the configuration tool from older versions of ENS.","status":"published","published":"2022-05-24T17:09:04Z","modified":"2023-01-29T05:01:33Z","updated_at":"2026-11-02T14:44:51.258198Z"}],"nvd":[{"id":"CVE-2020-7251","description":"Improper access control vulnerability in Configuration Tool in McAfee Mcafee Endpoint Security (ENS) Prior to 10.6.1 February 2020 Update allows local users to disable security features via unauthorised use of the configuration tool from older versions of ENS.","status":"published","published":"2020-02-14T15:15:11.65Z","modified":"2026-06-17T03:24:35.707Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-358","CWE-863"],"updated_at":"2026-11-02T14:05:54.796125Z"}]}}