Security readout for executives and security teams
Plain-English summary
McAfee ENS Firewall for Windows may not correctly enforce existing allow or block rules after February 2020 updates. This could let unauthorized traffic through or block legitimate traffic. The business risk is weakened endpoint firewall control across affected Windows systems, with potential confidentiality, integrity, and availability impact.
Executive priority
Treat as a high-priority hygiene and control-assurance issue for environments still running old McAfee ENS Firewall versions. The flaw affects policy enforcement rather than a direct unauthenticated takeover, but endpoint firewall misbehavior can undermine segmentation assumptions and incident containment.
Technical view
CVE-2020-7278 is a CWE-284 access control issue in McAfee Endpoint Security Firewall for Windows. ENS 10.7.x and 10.6.x before the April 2020 updates mishandled pre-existing firewall rules when updating to February 2020 updates. CVSS 3.1 score is 7.4 with network attack vector, low complexity, low privileges, no user interaction, and changed scope.
Likely exposure
Exposure is likely limited to organizations running McAfee Endpoint Security Firewall for Windows 10.7.x or 10.6.x that had not applied the April 2020 updates. Systems without ENS Firewall, non-Windows endpoints, or endpoints already updated beyond the named versions are not indicated as affected in the provided sources.
Exploitation context
The provided sources do not show CISA KEV listing or confirmed active exploitation. The CVE description says remote attackers and local users could allow or block unauthorized traffic because pre-existing rules were not handled correctly. Evidence does not include public exploit details.
Researcher notes
The key exposure condition is not just product presence; it involves ENS Firewall 10.7.x or 10.6.x before April 2020 updates and pre-existing rules mishandled during February 2020 updates. Validate rule enforcement carefully, but avoid assuming broader McAfee products are affected without vendor confirmation.
Mitigation direction
- Identify endpoints running McAfee Endpoint Security Firewall for Windows 10.7.x or 10.6.x.
- Apply McAfee ENS 10.7.0 April 2020 or 10.6.1 April 2020 updates.
- Review McAfee SB10309 for vendor-specific remediation and operational notes.
- Re-audit firewall allow and block rules after updating affected endpoints.
- Prioritize systems where endpoint firewall policy protects sensitive segments or remote access paths.
Validation and detection
- Inventory installed ENS Firewall versions on Windows endpoints.
- Confirm endpoints are at or beyond the April 2020 update levels.
- Compare configured firewall rules with observed enforcement in approved validation testing.
- Review change history for February 2020 ENS updates on affected systems.
- Check security monitoring for unexpected allowed or blocked endpoint traffic.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2020-7278 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L3.13.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.4HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Source materials
- CVE List V5 sourceCVE List V5
- https://kc.mcafee.com/corporate/index?page=content&id=SB10309CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.