Only the 32-bit version of GVC is vulnerable. While first two vulnerabilities apply to the installer, this one is in the application itself. 32-Bit Global VPN Client DLL Highjacking over Microsoft Foundation Class DLLs.
Only the last three 64-bit versions 4., 4. Therefore, all organizations and/or users who have installed the latest GVC version have the problematic RarSFX folder and its vulnerable component (RunMSI.exe), which could lead to potential exploitation of the first vulnerability above. Global VPN Client Installer being unable to remove RarSFX folder and its content after installation.This includes both the 32-Bit as well as 64-bit installers. Global VPN Client DLL Search Order Hijacking via Application Installer (RunMSI.exe).(32-bit and 64-bit) and earlier versions have three specific vulnerabilities in one of the installer components as outlined below: SonicWall has confirmed that Global VPN Client (GVC) installer 4.
Successful exploitation via a privileged user could potentially result in command execution in the target system. SonicWall PSIRT has worked with engineering and product teams to confirm and correct three vulnerabilities associated with the SonicWall Global VPN Client (GVC), two of which impact the included client installer.