Read the docs
TI-2020-04754 Aliases CVE-2020-5833GHSA-3mjh-34gx-h2r7

Out-of-bounds read in Symantec Endpoint Protection Manager

Priority LOW 16CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.

Summary

Symantec Endpoint Protection Manager, prior to 14.3, may be susceptible to an out of bounds vulnerability, which is a type of issue that results in an existing application reading memory outside of the bounds of the memory that had been allocated to the program.

Why it matters now

EPSS 0.00359 29th percentileScored 2026-11-07
Fix Fixed Symantec Endpoint Protection Manager: 14.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Symantec Endpoint Protection Managerbefore 14.314.3Patch availableCNA
  • Symantec Endpoint Protection Manager Vendor— Affected before 14.3 Fixed in 14.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:symantec:endpoint_protection_manager:*:*:*:*:*:*:*:*before 14.3VulnerableSymantec
  • cpe:2.3:a:symantec:endpoint_protection_manager:*:*:*:*:*:*:*:* Versions before 14.3 Vulnerable ·Symantec

Remediation

  • Fix · CNA Symantec Endpoint Protection Manager Fixed in 14.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-5833
  2. 2026-10-03 Alias added: GHSA-3mjh-34gx-h2r7

References

Advisory 1

  • TI-2015-01347 The management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before… CVSS 2.0HIGH 7.5
  • TI-2013-04383 The management console in Symantec Endpoint Protection Manager (SEPM) 11.0 before… CVSS 2.0HIGH 7.5
  • TI-2015-01350 The management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before… CVSS 2.0HIGH 8.5
  • TI-2015-01348 The management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before… CVSS 2.0MEDIUM 5.5
  • TI-2013-04384 SQL injection vulnerability in the management console in Symantec Endpoint Protection… CVSS 2.0MEDIUM 6.5
  • TI-2015-06762 The SysPlant.sys driver in the Application and Device Control (ADC) component in the… CVSS 3.0HIGH 8.8
See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences