CVE-2018-6755 in True Key
Summary
by MITRE
Weak Directory Permission Vulnerability in Microsoft Windows client in McAfee True Key (TK) 5.1.230.7 and earlier allows local users to execute arbitrary code via specially crafted malware.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/04/2025
The vulnerability identified as CVE-2018-6755 represents a critical directory permission weakness within Microsoft Windows client systems that affects McAfee True Key version 5.1.230.7 and earlier implementations. This flaw stems from inadequate access controls and improper permission settings within the True Key application's directory structure, creating an exploitable condition that adversaries can leverage for privilege escalation and code execution. The vulnerability specifically targets the client-side Windows environment where True Key operates as a password management and security solution, making it particularly dangerous in enterprise and consumer settings where sensitive authentication data is stored.
The technical implementation of this vulnerability involves the manipulation of directory permissions that should normally restrict access to sensitive application components and stored credentials. When McAfee True Key creates its directory structure on Windows systems, it fails to properly enforce restrictive access controls that would normally prevent unauthorized modification or execution of components within its installation directory. This weakness allows local attackers to modify or replace critical application files with malicious payloads, effectively bypassing the application's intended security boundaries. The flaw operates at the file system level and can be exploited through techniques that involve creating symbolic links, modifying file permissions, or directly replacing executable components within the True Key directory hierarchy.
From an operational impact perspective, this vulnerability enables local privilege escalation attacks that can result in complete system compromise when exploited by malicious actors. The attack surface is particularly concerning because True Key applications typically store sensitive authentication data, including passwords and encryption keys, within their directory structures. An attacker who successfully exploits this weakness can execute arbitrary code with the privileges of the user running the True Key application, potentially leading to credential theft, data exfiltration, or further lateral movement within the compromised network. The vulnerability is especially dangerous in enterprise environments where multiple users may have local access to systems running vulnerable versions of True Key.
Security professionals should consider this vulnerability in the context of the CWE-276 weakness classification which specifically addresses improper file permissions and inadequate access control mechanisms. The vulnerability also maps to several ATT&CK techniques including privilege escalation through file permissions and execution through modification of applications. Organizations should implement immediate mitigations including updating to McAfee True Key version 5.1.231.0 or later which contains the necessary permission fixes, conducting thorough directory permission audits, and implementing application whitelisting policies to prevent unauthorized modifications. Additionally, system administrators should monitor for suspicious file access patterns and ensure that directory permissions follow the principle of least privilege, restricting write access to only authorized system components and users. The vulnerability underscores the critical importance of proper access control implementation in security applications where the compromise of directory permissions can lead to complete system compromise.