Security readout for executives and security teams
Plain-English summary
CVE-2018-10962 affects Shanghai 2345 Security Guard 3.7.0. A local user could bypass the product's intended process protections and terminate its security processes, weakening endpoint protection on that machine. The provided sources do not identify remote attack exposure or a vendor fix.
Executive priority
Treat this as a targeted endpoint protection reliability risk, not a broad remote compromise issue. Prioritize remediation where the product is still deployed on sensitive workstations or shared systems.
Technical view
The CVE states that 2345MPCSafe.exe, 2345SafeTray.exe, and 2345Speedup.exe do not properly account for mouse_event behavior. This allows local users to bypass process protection controls and terminate protected processes. No CVSS, CWE, patch details, or affected CPEs are included in the bundle.
Likely exposure
Exposure appears limited to systems running Shanghai 2345 Security Guard 3.7.0, especially legacy endpoints where the listed processes are present. The record does not identify other versions or products.
Exploitation context
A public GitHub proof-of-concept repository is referenced by the CVE record. The bundle does not include CISA KEV listing or other evidence of active exploitation. The described attacker position is local user access.
Researcher notes
The source data is sparse: vendor and product fields are marked n/a, and no CVSS or CWE is provided. The description names the product, version, processes, local user scope, and mouse_event-related protection bypass. Avoid assuming broader version impact.
Mitigation direction
- Inventory endpoints for Shanghai 2345 Security Guard 3.7.0.
- Check vendor guidance for fixed or supported versions.
- Replace unsupported installations if no vendor fix is available.
- Restrict local interactive access to trusted users.
- Monitor unexpected termination of listed security processes.
Validation and detection
- Confirm whether the listed executable names exist on endpoints.
- Record exact product version from installed software inventory.
- Review endpoint logs for abnormal security process termination.
- Check whether process protection remains enabled after user activity.
- Document compensating controls for any remaining legacy installs.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-10962 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/rebol0x6c/2345_mouse_pocCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.