« Back to list

CVE-2020-13177

Status: ModifiedHigh (7.8)—

The support bundler in Teradici PCoIP Standard Agent for Windows and Graphics Agent for Windows versions prior to 20.04.1 and 20.07.0 does not use hard coded paths for certain Windows binaries, which allows an attacker to gain elevated privileges via execution of a malicious binary placed in the system path.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (2)

Teradici — Graphics AgentTeradici — Pcoip Standard Agent

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2020-13177",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.4,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.4,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@teradici.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "- PCoIP Standard Agent for Windows - PCoIP Graphics Agent for Windows",
          "versions": [
            {
              "status": "affected",
              "version": "PCoIP Standard Agent for Windows 20.04.0 and earlier, PCoIP Graphics Agent for Windows 20.04.0 and earlier"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-08-11T18:15:12.677",
  "references": [
    {
      "url": "https://advisory.teradici.com/security-advisories/60/",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security@teradici.com"
    },
    {
      "url": "https://advisory.teradici.com/security-advisories/60/",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@teradici.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-427"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-427"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The support bundler in Teradici PCoIP Standard Agent for Windows and Graphics Agent for Windows versions prior to 20.04.1 and 20.07.0 does not use hard coded paths for certain Windows binaries, which allows an attacker to gain elevated privileges via execution of a malicious binary placed in the system path."
    },
    {
      "lang": "es",
      "value": "El paquete de soporte en Teradici PCoIP Standard Agent para Windows y Graphics Agent para Windows versiones anteriores a 20.04.1 y 20.07.0, no usa rutas embebidas para determinados binarios de Windows, lo que permite a un atacante alcanzar privilegios elevados mediante una ejecución de un binario malicioso colocado en la ruta del sistema"
    }
  ],
  "lastModified": "2026-06-17T02:52:44.530",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:teradici:graphics_agent:*:*:*:*:*:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "14D4B030-1438-47EC-AA0A-1E74CFFA34E3",
              "versionEndExcluding": "20.04.1"
            },
            {
              "criteria": "cpe:2.3:a:teradici:pcoip_standard_agent:*:*:*:*:*:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C746FBCC-92C4-40BA-9C88-0C9FD3494932",
              "versionEndExcluding": "20.04.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@teradici.com"
}