[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fR-e8JVM4QyJ45_Azb4LCrYaIieBFFsdvGjRts-giai8":3,"g5a-ex:sophos\u002Fsafeguard_lan_crypt_client@*":77,"g5a-family:sophos\u002Fsafeguard_lan_crypt_client":79},{"success":4,"data":5},true,{"product":6,"versions":22,"topVulnerabilitiesByEpss":26,"kevVulnerabilities":54,"seoMetadata":55,"meta":74},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":21},"sophos","safeguard_lan_crypt_client",3,7,0,"2018-07-09",[14,17,19],{"version":15,"cve_count":10,"kev_count":11,"has_kev":16},"3.90.1",false,{"version":18,"cve_count":10,"kev_count":11,"has_kev":16},"3.90.2",{"version":20,"cve_count":10,"kev_count":11,"has_kev":16},"3.95.1","Safeguard Lan Crypt Client by Sophos is a technology product with 3 tracked versions and 7 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[23,24,25],{"version":15,"cve_count":10,"kev_count":11,"has_kev":16},{"version":18,"cve_count":10,"kev_count":11,"has_kev":16},{"version":20,"cve_count":10,"kev_count":11,"has_kev":16},[27,34,37,40,43,46,50],{"cveId":28,"description":29,"publishedDate":12,"cvssScore":30,"cvssVersion":31,"severity":32,"isKev":16,"epssScore":33},"CVE-2018-6856","Sophos SafeGuard Enterprise before 8.00.5, SafeGuard Easy before 7.00.3, and SafeGuard LAN Crypt before 3.95.2 are vulnerable to Local Privilege Escalation via IOCTL 0x8020601C. By crafting an input buffer we can control the execution path to the point where a global variable will be written to a user controlled address. We can take advantage of this condition to zero-out the pointer to the security descriptor in the object header of a privileged process or modify the security descriptor itself and run code in the context of a process running as SYSTEM.",7.8,"v3.0","High",0.00614,{"cveId":35,"description":36,"publishedDate":12,"cvssScore":30,"cvssVersion":31,"severity":32,"isKev":16,"epssScore":33},"CVE-2018-6852","Sophos SafeGuard Enterprise before 8.00.5, SafeGuard Easy before 7.00.3, and SafeGuard LAN Crypt before 3.95.2 are vulnerable to Local Privilege Escalation via IOCTL 0x80202298. By crafting an input buffer we can control the execution path to the point where the nt!memset function is called to zero out contents of a user-controlled address. We can take advantage of this condition to zero-out the pointer to the security descriptor in the object header of a privileged process or modify the security descriptor itself and run code in the context of a process running as SYSTEM.",{"cveId":38,"description":39,"publishedDate":12,"cvssScore":30,"cvssVersion":31,"severity":32,"isKev":16,"epssScore":33},"CVE-2018-6853","Sophos SafeGuard Enterprise before 8.00.5, SafeGuard Easy before 7.00.3, and SafeGuard LAN Crypt before 3.95.2 are vulnerable to Local Privilege Escalation via IOCTL 0x80206024. By crafting an input buffer we can control the execution path to the point where a global variable will be written to a user controlled address. We can take advantage of this condition to zero-out the pointer to the security descriptor in the object header of a privileged process or modify the security descriptor itself and run code in the context of a process running as SYSTEM.",{"cveId":41,"description":42,"publishedDate":12,"cvssScore":30,"cvssVersion":31,"severity":32,"isKev":16,"epssScore":33},"CVE-2018-6851","Sophos SafeGuard Enterprise before 8.00.5, SafeGuard Easy before 7.00.3, and SafeGuard LAN Crypt before 3.95.2 are vulnerable to Local Privilege Escalation via IOCTL 0x80206040. By crafting an input buffer we can control the execution path to the point where the constant DWORD 0 will be written to a user-controlled address. We can take advantage of this condition to zero-out the pointer to the security descriptor in the object header of a privileged process or modify the security descriptor itself and run code in the context of a process running as SYSTEM.",{"cveId":44,"description":45,"publishedDate":12,"cvssScore":30,"cvssVersion":31,"severity":32,"isKev":16,"epssScore":33},"CVE-2018-6857","Sophos SafeGuard Enterprise before 8.00.5, SafeGuard Easy before 7.00.3, and SafeGuard LAN Crypt before 3.95.2 are vulnerable to Local Privilege Escalation via IOCTL 0x802022E0. By crafting an input buffer we can control the execution path to the point where the constant 0x12 will be written to a user-controlled address. We can take advantage of this condition to modify the SEP_TOKEN_PRIVILEGES structure of the Token object belonging to the exploit process and grant SE_DEBUG_NAME privilege. This allows the exploit process to interact with higher privileged processes running as SYSTEM and execute code in their security context.",{"cveId":47,"description":48,"publishedDate":12,"cvssScore":30,"cvssVersion":31,"severity":32,"isKev":16,"epssScore":49},"CVE-2018-6854","Sophos SafeGuard Enterprise before 8.00.5, SafeGuard Easy before 7.00.3, and SafeGuard LAN Crypt before 3.95.2 are vulnerable to Local Privilege Escalation via multiple IOCTLs, e.g., 0x8810200B, 0x8810200F, 0x8810201B, 0x8810201F, 0x8810202B, 0x8810202F, 0x8810203F, 0x8810204B, 0x88102003, 0x88102007, 0x88102013, 0x88102017, 0x88102027, 0x88102033, 0x88102037, 0x88102043, and 0x88102047. When some conditions in the user-controlled input buffer are not met, the driver writes an error code (0x2000001A) to a user-controlled address. Also, note that all the aforementioned IOCTLs use transfer type METHOD_NEITHER, which means that the I\u002FO manager does not validate any of the supplied pointers and buffer sizes. So, even though the driver checks for input\u002Foutput buffer sizes, it doesn't validate if the pointers to those buffers are actually valid. So, we can supply a pointer for the output buffer to a kernel address space address, and the error code will be written there. We can take advantage of this condition to modify the SEP_TOKEN_PRIVILEGES structure of the Token object belonging to the exploit process and grant SE_DEBUG_NAME privilege. This allows the exploit process to interact with higher privileged processes running as SYSTEM and execute code in their security context.",0.00601,{"cveId":51,"description":52,"publishedDate":12,"cvssScore":30,"cvssVersion":31,"severity":32,"isKev":16,"epssScore":53},"CVE-2018-6855","Sophos SafeGuard Enterprise before 8.00.5, SafeGuard Easy before 7.00.3, and SafeGuard LAN Crypt before 3.95.2 are vulnerable to Local Privilege Escalation via IOCTL 0x80202014. By crafting an input buffer we can control the execution path to the point where the constant 0xFFFFFFF will be written to a user-controlled address. We can take advantage of this condition to modify the SEP_TOKEN_PRIVILEGES structure of the Token object belonging to the exploit process and grant SE_DEBUG_NAME privilege. This allows the exploit process to interact with higher privileged processes running as SYSTEM and execute code in their security context.",0.00544,[],{"title":56,"metaDescription":57,"keywords":58,"structuredData":59},"Safeguard Lan Crypt Client by Sophos - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Safeguard Lan Crypt Client by Sophos covering 3 versions with 7 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Safeguard Lan Crypt Client vulnerabilities, Safeguard Lan Crypt Client security, Safeguard Lan Crypt Client CVE, Sophos Safeguard Lan Crypt Client, Safeguard Lan Crypt Client threat intelligence, Sophos security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":60,"@type":61,"name":62,"description":57,"url":63,"manufacturer":64,"applicationCategory":68,"softwareVersion":69,"mainEntity":70},"https:\u002F\u002Fschema.org","SoftwareApplication","Safeguard Lan Crypt Client","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Fsophos\u002Fsafeguard_lan_crypt_client",{"@type":65,"name":66,"url":67},"Organization","Sophos","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fsophos","Security Software","3 versions tracked",{"@type":71,"name":72,"description":73,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Safeguard Lan Crypt Client Security Vulnerabilities","Security vulnerabilities affecting Safeguard Lan Crypt Client by Sophos",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":75,"apiVersion":76},"2026-10-17T19:17:55.713Z","3.0",{"rows":78,"total":11,"capped":16,"failed":11},[],[]]