CVE-2012-2957: Symantec Web Gateway management console local privilege escalation via file inclusion

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityThe flaw gives complete host compromise with no authentication required, though it needs local access and a patch is available.

What it is

The management console in Symantec Web Gateway 5.0.x before 5.0.3.18 permits local users to gain privileges by modifying files, described as a file inclusion issue. Because the flaw yields full confidentiality, integrity and availability impact on the host, it matters for any deployment where untrusted local accounts or processes can reach the console's files.

Impact

An attacker with local access gains elevated privileges on the appliance, giving full control over confidentiality, integrity and availability of the affected system.

Attack surface

Reached locally through the management console; the CVSS vector AV:L/AC:L/Au:N/C:C/I:C/A:C indicates no authentication is required and no user interaction beyond local access. No remote or network vector is described.

Exploitation

Not listed in CISA KEV and no exploit tags appear in the references, but EPSS is high at roughly 0.59 (99th percentile), suggesting elevated likelihood of exploitation activity.

What to do

• Upgrade Symantec Web Gateway to 5.0.3.18 or later, which the advisory identifies as the fixed release.
• Restrict local login and shell access on the appliance to trusted administrators only.
• Audit and lock down file permissions on management console files so non-privileged users cannot modify them.
• Monitor the vendor advisory and CERT/CC note for any updated guidance or workarounds.

Detection

• Alert on unexpected changes to management console files or directories on Web Gateway hosts.
• Monitor for local privilege escalation attempts and unusual process execution by non-administrative accounts.
• Review authentication and local session logs for anomalous console access patterns.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.