CVE-2020-3427: 
Duo Authentication for Windows Logon vulnerability analysis and mitigation

The Windows Logon installer prior to version 4.1.2 contained an elevation of privilege vulnerability that could allow an authenticated local attacker to overwrite files in privileged directories (CVE-2020-3427). The vulnerability was discovered and disclosed in October 2020, affecting Duo Authentication for Windows Logon installations (Duo Docs).

The vulnerability existed in the Windows Logon installer component and was related to improper validation of file installation paths. This security flaw could allow an authenticated local attacker with user privileges to perform privileged file operations (NVD).

The vulnerability could allow an authenticated local attacker to overwrite files in privileged directories, potentially leading to elevation of privilege on the affected system. Importantly, the vulnerability was limited to the installer only and did not affect the application once installed (Duo Docs).

The vulnerability required local user access to exploit. No public exploits or active exploitation in the wild were reported at the time of disclosure.

The vulnerability was addressed in version 4.1.2 of the Duo Authentication for Windows Logon installer, released on October 14, 2020. Users were advised to upgrade to version 4.1.2 or later to mitigate the vulnerability (Duo Docs).