Read the docs
TI-2019-09545 Aliases CVE-2019-12756GHSA-38x5-gc75-363x

Symantec Endpoint Protection (SEP), prior to 14.2 RU2 may be susceptible to a password…

Priority LOW 12Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Symantec Endpoint Protection (SEP), prior to 14.2 RU2 may be susceptible to a password protection bypass vulnerability whereby the secondary layer of password protection could by bypassed for individuals with local administrator rights.

Why it matters now

EPSS 0.00303 23rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Symantec Endpoint Protection (SEP)prior to 14.2 RU2—No fix listedCNA
  • Symantec Endpoint Protection (SEP) Vendor— Affected prior to 14.2 RU2 Fixed in — No fix listed CNA

CPE configurations NVD · 50

CPEVersionsRoleVendor
cpe:2.3:a:symantec:endpoint_protection:11.0:-:*:*:*:*:*:*11.0VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:11.0:mr1:*:*:*:*:*:*11.0 mr1VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:11.0:mr2:*:*:*:*:*:*11.0 mr2VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:11.0:mr3:*:*:*:*:*:*11.0 mr3VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:11.0:mr4:*:*:*:*:*:*11.0 mr4VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:11.0:mr4-mp1a:*:*:*:*:*:*11.0 mr4-mp1aVulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:11.0:mr4-mp2:*:*:*:*:*:*11.0 mr4-mp2VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:11.0:ru5:*:*:*:*:*:*11.0 ru5VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:11.0:ru6:*:*:*:*:*:*11.0 ru6VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:11.0:ru6-mp1:*:*:*:*:*:*11.0 ru6-mp1VulnerableSymantec
  • cpe:2.3:a:symantec:endpoint_protection:11.0:-:*:*:*:*:*:* Versions 11.0 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:11.0:mr1:*:*:*:*:*:* Versions 11.0 mr1 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:11.0:mr2:*:*:*:*:*:* Versions 11.0 mr2 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:11.0:mr3:*:*:*:*:*:* Versions 11.0 mr3 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:11.0:mr4:*:*:*:*:*:* Versions 11.0 mr4 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:11.0:mr4-mp1a:*:*:*:*:*:* Versions 11.0 mr4-mp1a Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:11.0:mr4-mp2:*:*:*:*:*:* Versions 11.0 mr4-mp2 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:11.0:ru5:*:*:*:*:*:* Versions 11.0 ru5 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:11.0:ru6:*:*:*:*:*:* Versions 11.0 ru6 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:11.0:ru6-mp1:*:*:*:*:*:* Versions 11.0 ru6-mp1 Vulnerable ·Symantec
Show 40 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:symantec:endpoint_protection:11.0:ru6-mp2:*:*:*:*:*:*11.0 ru6-mp2VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:11.0:ru6-mp3:*:*:*:*:*:*11.0 ru6-mp3VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:11.0:ru6a:*:*:*:*:*:*11.0 ru6aVulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:11.0:ru7:*:*:*:*:*:*11.0 ru7VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:11.0:ru7-mp1:*:*:*:*:*:*11.0 ru7-mp1VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:11.0:ru7-mp2:*:*:*:*:*:*11.0 ru7-mp2VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:11.0:ru7-mp3:*:*:*:*:*:*11.0 ru7-mp3VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:11.0:ru7-mp4:*:*:*:*:*:*11.0 ru7-mp4VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:11.0:ru7-mp4a:*:*:*:*:*:*11.0 ru7-mp4aVulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:12.1:-:*:*:*:*:*:*12.1VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:12.1:ru1:*:*:*:*:*:*12.1 ru1VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:12.1:ru1-p1:*:*:*:*:*:*12.1 ru1-p1VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:12.1:ru2:*:*:*:*:*:*12.1 ru2VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:12.1:ru2-mp1:*:*:*:*:*:*12.1 ru2-mp1VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:12.1:ru3:*:*:*:*:*:*12.1 ru3VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:12.1:ru4:*:*:*:*:*:*12.1 ru4VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:12.1:ru4-mp1:*:*:*:*:*:*12.1 ru4-mp1VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:12.1:ru4-mp1a:*:*:*:*:*:*12.1 ru4-mp1aVulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:12.1:ru4-mp1b:*:*:*:*:*:*12.1 ru4-mp1bVulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:12.1:ru4a:*:*:*:*:*:*12.1 ru4aVulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:12.1:ru5:*:*:*:*:*:*12.1 ru5VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:12.1:ru6:*:*:*:*:*:*12.1 ru6VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:12.1:ru6-mp1:*:*:*:*:*:*12.1 ru6-mp1VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:12.1:ru6-mp2:*:*:*:*:*:*12.1 ru6-mp2VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:12.1:ru6-mp3:*:*:*:*:*:*12.1 ru6-mp3VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:12.1:ru6-mp4:*:*:*:*:*:*12.1 ru6-mp4VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:12.1:ru6-mp5:*:*:*:*:*:*12.1 ru6-mp5VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:12.1:ru6-mp6:*:*:*:*:*:*12.1 ru6-mp6VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:12.1:ru6-mp7:*:*:*:*:*:*12.1 ru6-mp7VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:12.1:ru6-mp8:*:*:*:*:*:*12.1 ru6-mp8VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:12.1:ru6-mp9:*:*:*:*:*:*12.1 ru6-mp9VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:14.0.0:-:*:*:*:*:*:*14.0.0VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:14.0.0:mp1:*:*:*:*:*:*14.0.0 mp1VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:14.0.0:mp2:*:*:*:*:*:*14.0.0 mp2VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:14.0.1:-:*:*:*:*:*:*14.0.1VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:14.0.1:mp1:*:*:*:*:*:*14.0.1 mp1VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:14.0.1:mp2:*:*:*:*:*:*14.0.1 mp2VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:14.2:-:*:*:*:*:*:*14.2VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:14.2:mp1:*:*:*:*:*:*14.2 mp1VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:14.2:ru1:*:*:*:*:*:*14.2 ru1VulnerableSymantec
  • cpe:2.3:a:symantec:endpoint_protection:11.0:ru6-mp2:*:*:*:*:*:* Versions 11.0 ru6-mp2 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:11.0:ru6-mp3:*:*:*:*:*:* Versions 11.0 ru6-mp3 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:11.0:ru6a:*:*:*:*:*:* Versions 11.0 ru6a Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:11.0:ru7:*:*:*:*:*:* Versions 11.0 ru7 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:11.0:ru7-mp1:*:*:*:*:*:* Versions 11.0 ru7-mp1 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:11.0:ru7-mp2:*:*:*:*:*:* Versions 11.0 ru7-mp2 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:11.0:ru7-mp3:*:*:*:*:*:* Versions 11.0 ru7-mp3 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:11.0:ru7-mp4:*:*:*:*:*:* Versions 11.0 ru7-mp4 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:11.0:ru7-mp4a:*:*:*:*:*:* Versions 11.0 ru7-mp4a Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:12.1:-:*:*:*:*:*:* Versions 12.1 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:12.1:ru1:*:*:*:*:*:* Versions 12.1 ru1 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:12.1:ru1-p1:*:*:*:*:*:* Versions 12.1 ru1-p1 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:12.1:ru2:*:*:*:*:*:* Versions 12.1 ru2 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:12.1:ru2-mp1:*:*:*:*:*:* Versions 12.1 ru2-mp1 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:12.1:ru3:*:*:*:*:*:* Versions 12.1 ru3 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:12.1:ru4:*:*:*:*:*:* Versions 12.1 ru4 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:12.1:ru4-mp1:*:*:*:*:*:* Versions 12.1 ru4-mp1 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:12.1:ru4-mp1a:*:*:*:*:*:* Versions 12.1 ru4-mp1a Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:12.1:ru4-mp1b:*:*:*:*:*:* Versions 12.1 ru4-mp1b Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:12.1:ru4a:*:*:*:*:*:* Versions 12.1 ru4a Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:12.1:ru5:*:*:*:*:*:* Versions 12.1 ru5 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:12.1:ru6:*:*:*:*:*:* Versions 12.1 ru6 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:12.1:ru6-mp1:*:*:*:*:*:* Versions 12.1 ru6-mp1 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:12.1:ru6-mp2:*:*:*:*:*:* Versions 12.1 ru6-mp2 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:12.1:ru6-mp3:*:*:*:*:*:* Versions 12.1 ru6-mp3 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:12.1:ru6-mp4:*:*:*:*:*:* Versions 12.1 ru6-mp4 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:12.1:ru6-mp5:*:*:*:*:*:* Versions 12.1 ru6-mp5 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:12.1:ru6-mp6:*:*:*:*:*:* Versions 12.1 ru6-mp6 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:12.1:ru6-mp7:*:*:*:*:*:* Versions 12.1 ru6-mp7 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:12.1:ru6-mp8:*:*:*:*:*:* Versions 12.1 ru6-mp8 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:12.1:ru6-mp9:*:*:*:*:*:* Versions 12.1 ru6-mp9 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:14.0.0:-:*:*:*:*:*:* Versions 14.0.0 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:14.0.0:mp1:*:*:*:*:*:* Versions 14.0.0 mp1 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:14.0.0:mp2:*:*:*:*:*:* Versions 14.0.0 mp2 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:14.0.1:-:*:*:*:*:*:* Versions 14.0.1 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:14.0.1:mp1:*:*:*:*:*:* Versions 14.0.1 mp1 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:14.0.1:mp2:*:*:*:*:*:* Versions 14.0.1 mp2 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:14.2:-:*:*:*:*:*:* Versions 14.2 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:14.2:mp1:*:*:*:*:*:* Versions 14.2 mp1 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:14.2:ru1:*:*:*:*:*:* Versions 14.2 ru1 Vulnerable ·Symantec

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-12756
  2. 2026-10-03 Alias added: GHSA-38x5-gc75-363x

References

Patch 1

  • TI-2009-01353 The Intel LANDesk Common Base Agent (CBA) in Symantec Alert Management System 2 (AMS2)… CVSS 2.0HIGH 10.0
  • TI-2009-01354 Multiple stack-based buffer overflows in IAO.EXE in the Intel Alert Originator Service in… CVSS 2.0HIGH 9.3
  • TI-2016-02020 The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec… CVSS 3.0HIGH 7.8
  • TI-2012-01284 The ZIP file parser in AhnLab V3 Internet Security 2011.01.18.00, AVG Anti-Virus… CVSS 2.0MEDIUM 4.3
  • TI-2012-01283 The Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus… CVSS 2.0MEDIUM 4.3
  • TI-2012-01281 The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir… CVSS 2.0MEDIUM 4.3
See all 70 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences