CVE-2024-5928 is a link following privilege escalation in the Patch Management Agent of VIPRE Advanced Security, scored 7.8 (High). A local attacker can abuse a symbolic link to delete a file and reach SYSTEM. VIPRE released an update, but the advisory gives no version number.
What's affected
The record lists VIPRE Advanced Security 12.0.1.214 and describes the Patch Management Agent following a symbolic link to delete a file the attacker should not be able to touch. The weakness is CWE-59, improper link resolution before file access. The attacker must first run low-privileged code on the machine.
ZDI-24-817 says the vendor released an update that addresses the flaw and points to the VIPRE Windows release notes. The advisory does not name a version. ZDI reported it on 1 December 2023 and published on 20 June 2024. The reference page in the record is dated 27 February 2024 by its URL, but I could not load it, so I cannot say which build holds the fix.
There is no conflict on severity: NVD gives 7.8 and I found no vendor score. Not listed as known exploited.
How to check if you're exposed
Find the installed VIPRE Advanced Security version in the product about screen or in your endpoint inventory. The record names 12.0.1.214 as affected.
Because the fixed build number is not given, compare your version with the current release in the VIPRE release notes and confirm the update that references this issue is installed. If you manage VIPRE centrally, check the console for agents that have not updated.
What to do now
- Update VIPRE Advanced Security through the vendor channel and confirm the Patch Management Agent updated too.
- Ask VIPRE support to confirm the exact fixed build for CVE-2024-5928 and record it.
- Limit who can log on to workstations and servers running the agent.
- Watch for unexpected file deletions by the agent in protected folders.
- Apply the same check for the two sibling VIPRE CVEs published the same day, CVE-2024-5929 and CVE-2024-5930.
Why it matters
Link following bugs come from a privileged process acting on a path without checking whether the path is a shortcut to somewhere else. A low-privileged user plants the link, and the SYSTEM service deletes or changes what the link points to.
A delete primitive sounds small, but on Windows deleting the right file can be turned into running code as SYSTEM. This is why local escalation bugs in security agents earn a High score even though the attacker needs a foothold first.
Quick check
Which VIPRE build fixes this?
The advisory does not say. ZDI states that an update exists. Confirm with VIPRE.
Can it be exploited from the network?
The record says the attacker must first execute low-privileged code locally.
Sources
- ZDI-24-817
- VIPRE Windows release notes for 27 February 2024 (listed in the record, I could not load it)
- NVD record for CVE-2024-5928
Last reviewed: 19 October 2026.
