LiveActive security incident?Get immediate response
CVE Record

CVE-2015-7965: SafeNet Authentication Service Windows Logon Agent uses a weak ACL for unspecified installation directories...

SafeNet Authentication Service Windows Logon Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module, a different vulnerability than CVE-2015-7966.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2015-7965 is a local privilege-escalation flaw in SafeNet Authentication Service Windows Logon Agent. The issue is weak access control on installation directories and executable modules, allowing a local user to modify an executable module and potentially gain higher privileges. The source bundle does not provide CVSS, affected versions, or confirmed active exploitation.

Executive priority

Treat this as an exposure-discovery and vendor-guidance item unless the agent is present on sensitive Windows systems. If deployed broadly, prioritize because authentication components running with elevated privileges can turn local access into higher-impact compromise.

Technical view

The vulnerability is described as weak ACLs on unspecified installation directories and executable modules in the SafeNet Authentication Service Windows Logon Agent. A local user could modify an executable module, creating a privilege-escalation path. It is distinct from CVE-2015-7966, but the provided evidence does not specify exact paths, versions, or fixed builds.

Likely exposure

Exposure is likely limited to Windows systems where SafeNet Authentication Service Windows Logon Agent is installed. The provided CVE metadata does not identify exact affected versions, CPEs, default install paths, or deployment prevalence.

Exploitation context

The available sources describe local privilege escalation, not remote compromise. There is no KEV listing and no provided source confirms active exploitation. Exploitation would require local user access and a vulnerable installation with writable agent directories or modules.

Researcher notes

Evidence is thin in the CVE metadata: no CVSS, CWE, versions, CPEs, paths, or patch identifiers are included. The strongest grounded finding is weak ACLs enabling local modification of executable modules in the Windows Logon Agent.

Mitigation direction

  • Inventory Windows hosts running SafeNet Authentication Service Windows Logon Agent.
  • Check SafeNet or Gemalto security guidance for fixed versions and supported remediation.
  • Verify installation directory and executable module ACLs align with vendor guidance.
  • Prioritize remediation on shared workstations, servers, and privileged-access systems.
  • Monitor affected hosts for unexpected modification of agent binaries or modules.

Validation and detection

  • Confirm whether SafeNet Authentication Service Windows Logon Agent is installed.
  • Record agent version and compare it with the vendor bulletin or support guidance.
  • Review ACLs on agent installation directories and executable modules.
  • Confirm standard local users cannot modify agent binaries or modules.
  • Check endpoint logs for unexpected changes to agent executable files.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2015-7965 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.