Search
Find a vulnerability
Search criteria
6 vulnerabilities found for smart_security_premium by eset
CVE-2024-0353 (GCVE-0-2024-0353)
Vulnerability from nvd – Published: 2024-02-15 07:40 – Updated: 2025-12-10 19:33
VLAI
EPSS
VEX
Title
Local privilege escalation in Windows products
Summary
Local privilege escalation vulnerability potentially allowed an attacker to misuse ESET’s file operations to delete files without having proper permission.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-20 19:22 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
Impacted products
22 products
| Vendor | Product | Version | |
|---|---|---|---|
| ESET, spol. s r.o. | ESET NOD32 Antivirus |
Affected:
0 , ≤ 16.2.15.0
(custom)
|
|
| ESET, spol. s r.o. | ESET Internet Security |
Affected:
0 , ≤ 16.2.15.0
(custom)
|
|
| ESET, spol. s r.o. | ESET Smart Security Premium |
Affected:
0 , ≤ 16.2.15.0
(custom)
|
|
| ESET, spol. s r.o. | ESET Security Ultimate |
Affected:
0 , ≤ 16.2.15.0
(custom)
|
|
| ESET, spol. s r.o. | ESET Endpoint Antivirus for Windows |
Affected:
0 , ≤ 10.1.2058.0
(custom)
Affected: 0 , ≤ 10.0.2049.0 (custom) Affected: 0 , ≤ 9.1.2066.0 (custom) Affected: 0 , ≤ 8.1.2052.0 (custom) |
|
| ESET, spol. s r.o. | ESET Endpoint Security for Windows |
Affected:
0 , ≤ 10.1.2058.0
(custom)
Affected: 0 , ≤ 10.0.2049.0 (custom) Affected: 0 , ≤ 9.1.2066.0 (custom) Affected: 0 , ≤ 8.1.2052.0 (custom) |
|
| ESET, spol. s r.o. | ESET Server Security for Windows Server |
Affected:
0 , ≤ 10.0.12014.0
(custom)
Affected: 0 , ≤ 9.0.12018.0 (custom) Affected: 0 , ≤ 8.0.12015.0 (custom) Affected: 0 , ≤ 7.3.12011.0 (custom) |
|
| ESET, spol. s r.o. | ESET Mail Security for Microsoft Exchange Server |
Affected:
0 , ≤ 10.1.10010.0
(custom)
Affected: 0 , ≤ 10.0.10017.0 (custom) Affected: 0 , ≤ 9.0.10011.0 (custom) Affected: 0 , ≤ 8.0.10022.0 (custom) Affected: 0 , ≤ 7.3.10014.0 (custom) |
|
| ESET, spol. s r.o. | ESET Mail Security for IBM Domino |
Affected:
0 , ≤ 10.0.14006.0
(custom)
Affected: 0 , ≤ 9.0.14007.0 (custom) Affected: 0 , ≤ 8.0.14010.0 (custom) Affected: 0 , ≤ 7.3.14004.0 (custom) |
|
| ESET, spol. s r.o. | ESET Security for Microsoft SharePoint Server |
Affected:
0 , ≤ 10.0.15004.0
(custom)
Affected: 0 , ≤ 9.0.15005.0 (custom) Affected: 0 , ≤ 8.0.15011.0 (custom) Affected: 0 , ≤ 7.3.15004.0 (custom) |
|
| ESET, spol. s r.o. | ESET File Security for Microsoft Azure |
Affected:
0 , ≤ all versions
(custom)
|
|
| eset | nod32_antivirus |
Affected:
0 , ≤ 16.2.15.0
(custom)
cpe:2.3:a:eset:nod32_antivirus:*:*:*:*:*:*:*:* |
|
| eset | internet_security |
Affected:
0 , ≤ 16.2.15.0
(custom)
cpe:2.3:a:eset:internet_security:*:*:*:*:*:*:*:* |
|
| eset | smart_security_premium |
Affected:
0 , ≤ 16.2.15.0
(custom)
cpe:2.3:a:eset:smart_security_premium:*:*:*:*:*:*:*:* |
|
| eset | security_ultimate |
Affected:
0 , ≤ 16.2.15.0
(custom)
cpe:2.3:a:eset:security_ultimate:*:*:*:*:*:*:*:* |
|
| eset | endpoint_antivirus |
Affected:
0 , ≤ 10.1.2058.0
(custom)
cpe:2.3:a:eset:endpoint_antivirus:-:*:*:*:*:windows:*:* |
|
| eset | endpoint_security |
Affected:
0 , ≤ 10.1.2058.0
(custom)
cpe:2.3:a:eset:endpoint_security:-:*:*:*:*:windows:*:* |
|
| eset | server_security |
Affected:
0 , ≤ 10.0.12014.0
(custom)
cpe:2.3:a:eset:server_security:-:*:*:*:*:windows_server:*:* |
|
| eset | mail_security |
Affected:
0 , ≤ 10.1.10010.0
(custom)
cpe:2.3:a:eset:mail_security:-:*:*:*:*:exchange_server:*:* |
|
| eset | mail_security |
Affected:
0 , ≤ 10.0.14006.0
(custom)
cpe:2.3:a:eset:mail_security:-:*:*:*:*:domino:*:* |
|
| eset | security |
Affected:
0 , ≤ 10.0.15004.0
(custom)
cpe:2.3:a:eset:security:-:*:*:*:*:sharepoint_server:*:* |
|
| eset | file_security |
Affected:
0 , ≤ *
(custom)
cpe:2.3:a:eset:file_security:-:*:*:*:*:azure:*:* |
Date Public
2024-02-14 11:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-12-10T19:33:58.732Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://packetstormsecurity.com/files/182464/ESET-NOD32-Antivirus-18.0.12.0-Unquoted-Service-Path.html"
},
{
"url": "https://packetstormsecurity.com/files/179495/ESET-NOD32-Antivirus-17.2.7.0-Unquoted-Service-Path.html"
},
{
"url": "https://www.exploit-db.com/exploits/51351"
},
{
"url": "https://www.exploit-db.com/exploits/51964"
},
{
"tags": [
"x_transferred"
],
"url": "https://support.eset.com/en/ca8612-eset-customer-advisory-link-following-local-privilege-escalation-vulnerability-in-eset-products-for-windows-fixed"
}
],
"title": "CVE Program Container",
"x_generator": {
"engine": "ADPogram 0.0.1"
}
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:eset:nod32_antivirus:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "nod32_antivirus",
"vendor": "eset",
"versions": [
{
"lessThanOrEqual": "16.2.15.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:eset:internet_security:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "internet_security",
"vendor": "eset",
"versions": [
{
"lessThanOrEqual": "16.2.15.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:eset:smart_security_premium:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "smart_security_premium",
"vendor": "eset",
"versions": [
{
"lessThanOrEqual": "16.2.15.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:eset:security_ultimate:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "security_ultimate",
"vendor": "eset",
"versions": [
{
"lessThanOrEqual": "16.2.15.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:eset:endpoint_antivirus:-:*:*:*:*:windows:*:*"
],
"defaultStatus": "unknown",
"product": "endpoint_antivirus",
"vendor": "eset",
"versions": [
{
"lessThanOrEqual": "10.1.2058.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:eset:endpoint_security:-:*:*:*:*:windows:*:*"
],
"defaultStatus": "unknown",
"product": "endpoint_security",
"vendor": "eset",
"versions": [
{
"lessThanOrEqual": "10.1.2058.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:eset:server_security:-:*:*:*:*:windows_server:*:*"
],
"defaultStatus": "unknown",
"product": "server_security",
"vendor": "eset",
"versions": [
{
"lessThanOrEqual": "10.0.12014.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:eset:mail_security:-:*:*:*:*:exchange_server:*:*"
],
"defaultStatus": "unknown",
"product": "mail_security",
"vendor": "eset",
"versions": [
{
"lessThanOrEqual": "10.1.10010.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:eset:mail_security:-:*:*:*:*:domino:*:*"
],
"defaultStatus": "unknown",
"product": "mail_security",
"vendor": "eset",
"versions": [
{
"lessThanOrEqual": "10.0.14006.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:eset:security:-:*:*:*:*:sharepoint_server:*:*"
],
"defaultStatus": "unknown",
"product": "security",
"vendor": "eset",
"versions": [
{
"lessThanOrEqual": "10.0.15004.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:eset:file_security:-:*:*:*:*:azure:*:*"
],
"defaultStatus": "unknown",
"product": "file_security",
"vendor": "eset",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-0353",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-20T19:22:48.853538Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-20T19:53:00.534Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ESET NOD32 Antivirus",
"vendor": "ESET, spol. s r.o.",
"versions": [
{
"lessThanOrEqual": "16.2.15.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ESET Internet Security",
"vendor": "ESET, spol. s r.o.",
"versions": [
{
"lessThanOrEqual": "16.2.15.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ESET Smart Security Premium",
"vendor": "ESET, spol. s r.o.",
"versions": [
{
"lessThanOrEqual": "16.2.15.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ESET Security Ultimate",
"vendor": "ESET, spol. s r.o.",
"versions": [
{
"lessThanOrEqual": "16.2.15.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ESET Endpoint Antivirus for Windows",
"vendor": "ESET, spol. s r.o.",
"versions": [
{
"lessThanOrEqual": "10.1.2058.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "10.0.2049.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "9.1.2066.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "8.1.2052.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ESET Endpoint Security for Windows",
"vendor": "ESET, spol. s r.o.",
"versions": [
{
"lessThanOrEqual": "10.1.2058.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "10.0.2049.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "9.1.2066.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "8.1.2052.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ESET Server Security for Windows Server",
"vendor": "ESET, spol. s r.o.",
"versions": [
{
"lessThanOrEqual": "10.0.12014.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "9.0.12018.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "8.0.12015.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "7.3.12011.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ESET Mail Security for Microsoft Exchange Server",
"vendor": "ESET, spol. s r.o.",
"versions": [
{
"lessThanOrEqual": "10.1.10010.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "10.0.10017.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "9.0.10011.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "8.0.10022.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "7.3.10014.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ESET Mail Security for IBM Domino",
"vendor": "ESET, spol. s r.o.",
"versions": [
{
"lessThanOrEqual": "10.0.14006.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "9.0.14007.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "8.0.14010.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "7.3.14004.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ESET Security for Microsoft SharePoint Server",
"vendor": "ESET, spol. s r.o.",
"versions": [
{
"lessThanOrEqual": "10.0.15004.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "9.0.15005.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "8.0.15011.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "7.3.15004.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ESET File Security for Microsoft Azure",
"vendor": "ESET, spol. s r.o.",
"versions": [
{
"lessThanOrEqual": "all versions",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"datePublic": "2024-02-14T11:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Local privilege escalation vulnerability potentially allowed an attacker to misuse ESET\u2019s file operations to delete files without having proper permission."
}
],
"value": "Local privilege escalation vulnerability potentially allowed an attacker to misuse ESET\u2019s file operations to delete files without having proper permission."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-15T07:40:24.786Z",
"orgId": "4a9b9929-2450-4021-b7b9-469a0255b215",
"shortName": "ESET"
},
"references": [
{
"url": "https://support.eset.com/en/ca8612-eset-customer-advisory-link-following-local-privilege-escalation-vulnerability-in-eset-products-for-windows-fixed"
}
],
"source": {
"advisory": "ca8612",
"discovery": "UNKNOWN"
},
"title": "Local privilege escalation in Windows products",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "4a9b9929-2450-4021-b7b9-469a0255b215",
"assignerShortName": "ESET",
"cveId": "CVE-2024-0353",
"datePublished": "2024-02-15T07:40:24.786Z",
"dateReserved": "2024-01-09T14:21:58.755Z",
"dateUpdated": "2025-12-10T19:33:58.732Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-7043 (GCVE-0-2023-7043)
Vulnerability from nvd – Published: 2024-01-31 12:51 – Updated: 2024-10-17 17:54
VLAI
EPSS
VEX
Title
Unquoted path privilege vulnerability in ESET products for Windows
Summary
Unquoted service path in ESET products allows to
drop a prepared program to a specific location and run on boot with the
NT AUTHORITY\NetworkService permissions.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-01-31 15:52 UTC
CWE
- CWE-428 - Unquoted Search Path or Element
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://support.eset.com/en/ca8602 |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| ESET, spol. s r.o. | ESET Endpoint Security |
Affected:
10.1.2046.x , ≤ 10.1.2063.x
(custom)
|
|
| ESET, spol. s r.o. | ESET Endpoint Antivirus |
Affected:
10.1.2046.x , ≤ 10.1.2063.x
(custom)
|
|
| ESET, spol. s r.o. | ESET NOD32 Antivirus |
Affected:
16.1.14.0 , ≤ 16.2.15.0
(custom)
|
|
| ESET, spol. s r.o. | ESET Internet Security |
Affected:
16.1.14.0 , ≤ 16.2.15.0
(custom)
|
|
| ESET, spol. s r.o. | ESET Smart Security Premium |
Affected:
16.1.14.0 , ≤ 16.2.15.0
(custom)
|
|
| ESET, spol. s r.o. | ESET Mail Security for Microsoft Exchange Server |
Affected:
10.1.10012.0
|
Date Public
2024-01-26 11:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T08:50:07.939Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://support.eset.com/en/ca8602"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-7043",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-01-31T15:52:23.258496Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-17T17:54:28.120Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ESET Endpoint Security",
"vendor": "ESET, spol. s r.o.",
"versions": [
{
"lessThanOrEqual": "10.1.2063.x",
"status": "affected",
"version": "10.1.2046.x",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ESET Endpoint Antivirus",
"vendor": "ESET, spol. s r.o.",
"versions": [
{
"lessThanOrEqual": "10.1.2063.x",
"status": "affected",
"version": "10.1.2046.x",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ESET NOD32 Antivirus",
"vendor": "ESET, spol. s r.o.",
"versions": [
{
"lessThanOrEqual": "16.2.15.0",
"status": "affected",
"version": "16.1.14.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ESET Internet Security",
"vendor": "ESET, spol. s r.o.",
"versions": [
{
"lessThanOrEqual": "16.2.15.0",
"status": "affected",
"version": "16.1.14.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ESET Smart Security Premium",
"vendor": "ESET, spol. s r.o.",
"versions": [
{
"lessThanOrEqual": "16.2.15.0",
"status": "affected",
"version": "16.1.14.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ESET Mail Security for Microsoft Exchange Server",
"vendor": "ESET, spol. s r.o.",
"versions": [
{
"status": "affected",
"version": "10.1.10012.0"
}
]
}
],
"datePublic": "2024-01-26T11:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Unquoted service path in ESET products allows to \n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003edrop a prepared program to a specific location\u003c/span\u003e\u0026nbsp;and\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003erun on boot with \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ethe \n\nNT AUTHORITY\\NetworkService\u0026nbsp;permissions.\u003c/span\u003e"
}
],
"value": "Unquoted service path in ESET products allows to \n\ndrop a prepared program to a specific location\u00a0and\u00a0run on boot with the \n\nNT AUTHORITY\\NetworkService\u00a0permissions."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-428",
"description": "CWE-428 Unquoted Search Path or Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-01-31T12:52:10.301Z",
"orgId": "4a9b9929-2450-4021-b7b9-469a0255b215",
"shortName": "ESET"
},
"references": [
{
"url": "https://support.eset.com/en/ca8602"
}
],
"source": {
"advisory": "ca8602",
"discovery": "UNKNOWN"
},
"title": "Unquoted path privilege vulnerability in ESET products for Windows",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "4a9b9929-2450-4021-b7b9-469a0255b215",
"assignerShortName": "ESET",
"cveId": "CVE-2023-7043",
"datePublished": "2024-01-31T12:51:38.253Z",
"dateReserved": "2023-12-21T12:14:56.731Z",
"dateUpdated": "2024-10-17T17:54:28.120Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-0649 (GCVE-0-2018-0649)
Vulnerability from nvd – Published: 2018-09-07 14:00 – Updated: 2024-08-05 03:35
VLAI
EPSS
VEX
Summary
Untrusted search path vulnerability in the installers of multiple Canon IT Solutions Inc. software programs (ESET Smart Security Premium, ESET Internet Security, ESET Smart Security, ESET NOD32 Antivirus, DESlock+ Pro, and CompuSec (all programs except packaged ones)) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Severity
No CVSS data available.
CWE
- Untrusted search path vulnerability
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://jvn.jp/en/jp/JVN41452671/index.html | third-party-advisoryx_refsource_JVN |
| https://eset-support.canon-its.jp/faq/show/10720?… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Canon IT Solutions Inc. | The installers of multiple Canon IT Solutions Inc. software programs |
Affected:
(ESET Smart Security Premium, ESET Internet Security, ESET Smart Security, ESET NOD32 Antivirus, DESlock+ Pro, and CompuSec (all programs except packaged ones))
|
Date Public
2018-07-18 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T03:35:48.946Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "JVN#41452671",
"tags": [
"third-party-advisory",
"x_refsource_JVN",
"x_transferred"
],
"url": "http://jvn.jp/en/jp/JVN41452671/index.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://eset-support.canon-its.jp/faq/show/10720?site_domain=default"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "The installers of multiple Canon IT Solutions Inc. software programs",
"vendor": "Canon IT Solutions Inc.",
"versions": [
{
"status": "affected",
"version": "(ESET Smart Security Premium, ESET Internet Security, ESET Smart Security, ESET NOD32 Antivirus, DESlock+ Pro, and CompuSec (all programs except packaged ones))"
}
]
}
],
"datePublic": "2018-07-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Untrusted search path vulnerability in the installers of multiple Canon IT Solutions Inc. software programs (ESET Smart Security Premium, ESET Internet Security, ESET Smart Security, ESET NOD32 Antivirus, DESlock+ Pro, and CompuSec (all programs except packaged ones)) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Untrusted search path vulnerability",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-09-07T13:57:01.000Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"name": "JVN#41452671",
"tags": [
"third-party-advisory",
"x_refsource_JVN"
],
"url": "http://jvn.jp/en/jp/JVN41452671/index.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://eset-support.canon-its.jp/faq/show/10720?site_domain=default"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vultures@jpcert.or.jp",
"ID": "CVE-2018-0649",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "The installers of multiple Canon IT Solutions Inc. software programs",
"version": {
"version_data": [
{
"version_value": "(ESET Smart Security Premium, ESET Internet Security, ESET Smart Security, ESET NOD32 Antivirus, DESlock+ Pro, and CompuSec (all programs except packaged ones))"
}
]
}
}
]
},
"vendor_name": "Canon IT Solutions Inc."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Untrusted search path vulnerability in the installers of multiple Canon IT Solutions Inc. software programs (ESET Smart Security Premium, ESET Internet Security, ESET Smart Security, ESET NOD32 Antivirus, DESlock+ Pro, and CompuSec (all programs except packaged ones)) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Untrusted search path vulnerability"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "JVN#41452671",
"refsource": "JVN",
"url": "http://jvn.jp/en/jp/JVN41452671/index.html"
},
{
"name": "https://eset-support.canon-its.jp/faq/show/10720?site_domain=default",
"refsource": "CONFIRM",
"url": "https://eset-support.canon-its.jp/faq/show/10720?site_domain=default"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2018-0649",
"datePublished": "2018-09-07T14:00:00.000Z",
"dateReserved": "2017-11-27T00:00:00.000Z",
"dateUpdated": "2024-08-05T03:35:48.946Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-0353 (GCVE-0-2024-0353)
Vulnerability from cvelistv5 – Published: 2024-02-15 07:40 – Updated: 2025-12-10 19:33
VLAI
EPSS
VEX
Title
Local privilege escalation in Windows products
Summary
Local privilege escalation vulnerability potentially allowed an attacker to misuse ESET’s file operations to delete files without having proper permission.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-20 19:22 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
Impacted products
22 products
| Vendor | Product | Version | |
|---|---|---|---|
| ESET, spol. s r.o. | ESET NOD32 Antivirus |
Affected:
0 , ≤ 16.2.15.0
(custom)
|
|
| ESET, spol. s r.o. | ESET Internet Security |
Affected:
0 , ≤ 16.2.15.0
(custom)
|
|
| ESET, spol. s r.o. | ESET Smart Security Premium |
Affected:
0 , ≤ 16.2.15.0
(custom)
|
|
| ESET, spol. s r.o. | ESET Security Ultimate |
Affected:
0 , ≤ 16.2.15.0
(custom)
|
|
| ESET, spol. s r.o. | ESET Endpoint Antivirus for Windows |
Affected:
0 , ≤ 10.1.2058.0
(custom)
Affected: 0 , ≤ 10.0.2049.0 (custom) Affected: 0 , ≤ 9.1.2066.0 (custom) Affected: 0 , ≤ 8.1.2052.0 (custom) |
|
| ESET, spol. s r.o. | ESET Endpoint Security for Windows |
Affected:
0 , ≤ 10.1.2058.0
(custom)
Affected: 0 , ≤ 10.0.2049.0 (custom) Affected: 0 , ≤ 9.1.2066.0 (custom) Affected: 0 , ≤ 8.1.2052.0 (custom) |
|
| ESET, spol. s r.o. | ESET Server Security for Windows Server |
Affected:
0 , ≤ 10.0.12014.0
(custom)
Affected: 0 , ≤ 9.0.12018.0 (custom) Affected: 0 , ≤ 8.0.12015.0 (custom) Affected: 0 , ≤ 7.3.12011.0 (custom) |
|
| ESET, spol. s r.o. | ESET Mail Security for Microsoft Exchange Server |
Affected:
0 , ≤ 10.1.10010.0
(custom)
Affected: 0 , ≤ 10.0.10017.0 (custom) Affected: 0 , ≤ 9.0.10011.0 (custom) Affected: 0 , ≤ 8.0.10022.0 (custom) Affected: 0 , ≤ 7.3.10014.0 (custom) |
|
| ESET, spol. s r.o. | ESET Mail Security for IBM Domino |
Affected:
0 , ≤ 10.0.14006.0
(custom)
Affected: 0 , ≤ 9.0.14007.0 (custom) Affected: 0 , ≤ 8.0.14010.0 (custom) Affected: 0 , ≤ 7.3.14004.0 (custom) |
|
| ESET, spol. s r.o. | ESET Security for Microsoft SharePoint Server |
Affected:
0 , ≤ 10.0.15004.0
(custom)
Affected: 0 , ≤ 9.0.15005.0 (custom) Affected: 0 , ≤ 8.0.15011.0 (custom) Affected: 0 , ≤ 7.3.15004.0 (custom) |
|
| ESET, spol. s r.o. | ESET File Security for Microsoft Azure |
Affected:
0 , ≤ all versions
(custom)
|
|
| eset | nod32_antivirus |
Affected:
0 , ≤ 16.2.15.0
(custom)
cpe:2.3:a:eset:nod32_antivirus:*:*:*:*:*:*:*:* |
|
| eset | internet_security |
Affected:
0 , ≤ 16.2.15.0
(custom)
cpe:2.3:a:eset:internet_security:*:*:*:*:*:*:*:* |
|
| eset | smart_security_premium |
Affected:
0 , ≤ 16.2.15.0
(custom)
cpe:2.3:a:eset:smart_security_premium:*:*:*:*:*:*:*:* |
|
| eset | security_ultimate |
Affected:
0 , ≤ 16.2.15.0
(custom)
cpe:2.3:a:eset:security_ultimate:*:*:*:*:*:*:*:* |
|
| eset | endpoint_antivirus |
Affected:
0 , ≤ 10.1.2058.0
(custom)
cpe:2.3:a:eset:endpoint_antivirus:-:*:*:*:*:windows:*:* |
|
| eset | endpoint_security |
Affected:
0 , ≤ 10.1.2058.0
(custom)
cpe:2.3:a:eset:endpoint_security:-:*:*:*:*:windows:*:* |
|
| eset | server_security |
Affected:
0 , ≤ 10.0.12014.0
(custom)
cpe:2.3:a:eset:server_security:-:*:*:*:*:windows_server:*:* |
|
| eset | mail_security |
Affected:
0 , ≤ 10.1.10010.0
(custom)
cpe:2.3:a:eset:mail_security:-:*:*:*:*:exchange_server:*:* |
|
| eset | mail_security |
Affected:
0 , ≤ 10.0.14006.0
(custom)
cpe:2.3:a:eset:mail_security:-:*:*:*:*:domino:*:* |
|
| eset | security |
Affected:
0 , ≤ 10.0.15004.0
(custom)
cpe:2.3:a:eset:security:-:*:*:*:*:sharepoint_server:*:* |
|
| eset | file_security |
Affected:
0 , ≤ *
(custom)
cpe:2.3:a:eset:file_security:-:*:*:*:*:azure:*:* |
Date Public
2024-02-14 11:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-12-10T19:33:58.732Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://packetstormsecurity.com/files/182464/ESET-NOD32-Antivirus-18.0.12.0-Unquoted-Service-Path.html"
},
{
"url": "https://packetstormsecurity.com/files/179495/ESET-NOD32-Antivirus-17.2.7.0-Unquoted-Service-Path.html"
},
{
"url": "https://www.exploit-db.com/exploits/51351"
},
{
"url": "https://www.exploit-db.com/exploits/51964"
},
{
"tags": [
"x_transferred"
],
"url": "https://support.eset.com/en/ca8612-eset-customer-advisory-link-following-local-privilege-escalation-vulnerability-in-eset-products-for-windows-fixed"
}
],
"title": "CVE Program Container",
"x_generator": {
"engine": "ADPogram 0.0.1"
}
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:eset:nod32_antivirus:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "nod32_antivirus",
"vendor": "eset",
"versions": [
{
"lessThanOrEqual": "16.2.15.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:eset:internet_security:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "internet_security",
"vendor": "eset",
"versions": [
{
"lessThanOrEqual": "16.2.15.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:eset:smart_security_premium:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "smart_security_premium",
"vendor": "eset",
"versions": [
{
"lessThanOrEqual": "16.2.15.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:eset:security_ultimate:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "security_ultimate",
"vendor": "eset",
"versions": [
{
"lessThanOrEqual": "16.2.15.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:eset:endpoint_antivirus:-:*:*:*:*:windows:*:*"
],
"defaultStatus": "unknown",
"product": "endpoint_antivirus",
"vendor": "eset",
"versions": [
{
"lessThanOrEqual": "10.1.2058.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:eset:endpoint_security:-:*:*:*:*:windows:*:*"
],
"defaultStatus": "unknown",
"product": "endpoint_security",
"vendor": "eset",
"versions": [
{
"lessThanOrEqual": "10.1.2058.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:eset:server_security:-:*:*:*:*:windows_server:*:*"
],
"defaultStatus": "unknown",
"product": "server_security",
"vendor": "eset",
"versions": [
{
"lessThanOrEqual": "10.0.12014.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:eset:mail_security:-:*:*:*:*:exchange_server:*:*"
],
"defaultStatus": "unknown",
"product": "mail_security",
"vendor": "eset",
"versions": [
{
"lessThanOrEqual": "10.1.10010.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:eset:mail_security:-:*:*:*:*:domino:*:*"
],
"defaultStatus": "unknown",
"product": "mail_security",
"vendor": "eset",
"versions": [
{
"lessThanOrEqual": "10.0.14006.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:eset:security:-:*:*:*:*:sharepoint_server:*:*"
],
"defaultStatus": "unknown",
"product": "security",
"vendor": "eset",
"versions": [
{
"lessThanOrEqual": "10.0.15004.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:eset:file_security:-:*:*:*:*:azure:*:*"
],
"defaultStatus": "unknown",
"product": "file_security",
"vendor": "eset",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-0353",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-20T19:22:48.853538Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-20T19:53:00.534Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ESET NOD32 Antivirus",
"vendor": "ESET, spol. s r.o.",
"versions": [
{
"lessThanOrEqual": "16.2.15.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ESET Internet Security",
"vendor": "ESET, spol. s r.o.",
"versions": [
{
"lessThanOrEqual": "16.2.15.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ESET Smart Security Premium",
"vendor": "ESET, spol. s r.o.",
"versions": [
{
"lessThanOrEqual": "16.2.15.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ESET Security Ultimate",
"vendor": "ESET, spol. s r.o.",
"versions": [
{
"lessThanOrEqual": "16.2.15.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ESET Endpoint Antivirus for Windows",
"vendor": "ESET, spol. s r.o.",
"versions": [
{
"lessThanOrEqual": "10.1.2058.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "10.0.2049.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "9.1.2066.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "8.1.2052.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ESET Endpoint Security for Windows",
"vendor": "ESET, spol. s r.o.",
"versions": [
{
"lessThanOrEqual": "10.1.2058.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "10.0.2049.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "9.1.2066.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "8.1.2052.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ESET Server Security for Windows Server",
"vendor": "ESET, spol. s r.o.",
"versions": [
{
"lessThanOrEqual": "10.0.12014.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "9.0.12018.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "8.0.12015.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "7.3.12011.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ESET Mail Security for Microsoft Exchange Server",
"vendor": "ESET, spol. s r.o.",
"versions": [
{
"lessThanOrEqual": "10.1.10010.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "10.0.10017.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "9.0.10011.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "8.0.10022.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "7.3.10014.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ESET Mail Security for IBM Domino",
"vendor": "ESET, spol. s r.o.",
"versions": [
{
"lessThanOrEqual": "10.0.14006.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "9.0.14007.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "8.0.14010.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "7.3.14004.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ESET Security for Microsoft SharePoint Server",
"vendor": "ESET, spol. s r.o.",
"versions": [
{
"lessThanOrEqual": "10.0.15004.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "9.0.15005.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "8.0.15011.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "7.3.15004.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ESET File Security for Microsoft Azure",
"vendor": "ESET, spol. s r.o.",
"versions": [
{
"lessThanOrEqual": "all versions",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"datePublic": "2024-02-14T11:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Local privilege escalation vulnerability potentially allowed an attacker to misuse ESET\u2019s file operations to delete files without having proper permission."
}
],
"value": "Local privilege escalation vulnerability potentially allowed an attacker to misuse ESET\u2019s file operations to delete files without having proper permission."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-15T07:40:24.786Z",
"orgId": "4a9b9929-2450-4021-b7b9-469a0255b215",
"shortName": "ESET"
},
"references": [
{
"url": "https://support.eset.com/en/ca8612-eset-customer-advisory-link-following-local-privilege-escalation-vulnerability-in-eset-products-for-windows-fixed"
}
],
"source": {
"advisory": "ca8612",
"discovery": "UNKNOWN"
},
"title": "Local privilege escalation in Windows products",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "4a9b9929-2450-4021-b7b9-469a0255b215",
"assignerShortName": "ESET",
"cveId": "CVE-2024-0353",
"datePublished": "2024-02-15T07:40:24.786Z",
"dateReserved": "2024-01-09T14:21:58.755Z",
"dateUpdated": "2025-12-10T19:33:58.732Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-7043 (GCVE-0-2023-7043)
Vulnerability from cvelistv5 – Published: 2024-01-31 12:51 – Updated: 2024-10-17 17:54
VLAI
EPSS
VEX
Title
Unquoted path privilege vulnerability in ESET products for Windows
Summary
Unquoted service path in ESET products allows to
drop a prepared program to a specific location and run on boot with the
NT AUTHORITY\NetworkService permissions.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-01-31 15:52 UTC
CWE
- CWE-428 - Unquoted Search Path or Element
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://support.eset.com/en/ca8602 |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| ESET, spol. s r.o. | ESET Endpoint Security |
Affected:
10.1.2046.x , ≤ 10.1.2063.x
(custom)
|
|
| ESET, spol. s r.o. | ESET Endpoint Antivirus |
Affected:
10.1.2046.x , ≤ 10.1.2063.x
(custom)
|
|
| ESET, spol. s r.o. | ESET NOD32 Antivirus |
Affected:
16.1.14.0 , ≤ 16.2.15.0
(custom)
|
|
| ESET, spol. s r.o. | ESET Internet Security |
Affected:
16.1.14.0 , ≤ 16.2.15.0
(custom)
|
|
| ESET, spol. s r.o. | ESET Smart Security Premium |
Affected:
16.1.14.0 , ≤ 16.2.15.0
(custom)
|
|
| ESET, spol. s r.o. | ESET Mail Security for Microsoft Exchange Server |
Affected:
10.1.10012.0
|
Date Public
2024-01-26 11:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T08:50:07.939Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://support.eset.com/en/ca8602"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-7043",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-01-31T15:52:23.258496Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-17T17:54:28.120Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ESET Endpoint Security",
"vendor": "ESET, spol. s r.o.",
"versions": [
{
"lessThanOrEqual": "10.1.2063.x",
"status": "affected",
"version": "10.1.2046.x",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ESET Endpoint Antivirus",
"vendor": "ESET, spol. s r.o.",
"versions": [
{
"lessThanOrEqual": "10.1.2063.x",
"status": "affected",
"version": "10.1.2046.x",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ESET NOD32 Antivirus",
"vendor": "ESET, spol. s r.o.",
"versions": [
{
"lessThanOrEqual": "16.2.15.0",
"status": "affected",
"version": "16.1.14.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ESET Internet Security",
"vendor": "ESET, spol. s r.o.",
"versions": [
{
"lessThanOrEqual": "16.2.15.0",
"status": "affected",
"version": "16.1.14.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ESET Smart Security Premium",
"vendor": "ESET, spol. s r.o.",
"versions": [
{
"lessThanOrEqual": "16.2.15.0",
"status": "affected",
"version": "16.1.14.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ESET Mail Security for Microsoft Exchange Server",
"vendor": "ESET, spol. s r.o.",
"versions": [
{
"status": "affected",
"version": "10.1.10012.0"
}
]
}
],
"datePublic": "2024-01-26T11:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Unquoted service path in ESET products allows to \n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003edrop a prepared program to a specific location\u003c/span\u003e\u0026nbsp;and\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003erun on boot with \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ethe \n\nNT AUTHORITY\\NetworkService\u0026nbsp;permissions.\u003c/span\u003e"
}
],
"value": "Unquoted service path in ESET products allows to \n\ndrop a prepared program to a specific location\u00a0and\u00a0run on boot with the \n\nNT AUTHORITY\\NetworkService\u00a0permissions."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-428",
"description": "CWE-428 Unquoted Search Path or Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-01-31T12:52:10.301Z",
"orgId": "4a9b9929-2450-4021-b7b9-469a0255b215",
"shortName": "ESET"
},
"references": [
{
"url": "https://support.eset.com/en/ca8602"
}
],
"source": {
"advisory": "ca8602",
"discovery": "UNKNOWN"
},
"title": "Unquoted path privilege vulnerability in ESET products for Windows",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "4a9b9929-2450-4021-b7b9-469a0255b215",
"assignerShortName": "ESET",
"cveId": "CVE-2023-7043",
"datePublished": "2024-01-31T12:51:38.253Z",
"dateReserved": "2023-12-21T12:14:56.731Z",
"dateUpdated": "2024-10-17T17:54:28.120Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-0649 (GCVE-0-2018-0649)
Vulnerability from cvelistv5 – Published: 2018-09-07 14:00 – Updated: 2024-08-05 03:35
VLAI
EPSS
VEX
Summary
Untrusted search path vulnerability in the installers of multiple Canon IT Solutions Inc. software programs (ESET Smart Security Premium, ESET Internet Security, ESET Smart Security, ESET NOD32 Antivirus, DESlock+ Pro, and CompuSec (all programs except packaged ones)) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Severity
No CVSS data available.
CWE
- Untrusted search path vulnerability
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://jvn.jp/en/jp/JVN41452671/index.html | third-party-advisoryx_refsource_JVN |
| https://eset-support.canon-its.jp/faq/show/10720?… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Canon IT Solutions Inc. | The installers of multiple Canon IT Solutions Inc. software programs |
Affected:
(ESET Smart Security Premium, ESET Internet Security, ESET Smart Security, ESET NOD32 Antivirus, DESlock+ Pro, and CompuSec (all programs except packaged ones))
|
Date Public
2018-07-18 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T03:35:48.946Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "JVN#41452671",
"tags": [
"third-party-advisory",
"x_refsource_JVN",
"x_transferred"
],
"url": "http://jvn.jp/en/jp/JVN41452671/index.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://eset-support.canon-its.jp/faq/show/10720?site_domain=default"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "The installers of multiple Canon IT Solutions Inc. software programs",
"vendor": "Canon IT Solutions Inc.",
"versions": [
{
"status": "affected",
"version": "(ESET Smart Security Premium, ESET Internet Security, ESET Smart Security, ESET NOD32 Antivirus, DESlock+ Pro, and CompuSec (all programs except packaged ones))"
}
]
}
],
"datePublic": "2018-07-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Untrusted search path vulnerability in the installers of multiple Canon IT Solutions Inc. software programs (ESET Smart Security Premium, ESET Internet Security, ESET Smart Security, ESET NOD32 Antivirus, DESlock+ Pro, and CompuSec (all programs except packaged ones)) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Untrusted search path vulnerability",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-09-07T13:57:01.000Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"name": "JVN#41452671",
"tags": [
"third-party-advisory",
"x_refsource_JVN"
],
"url": "http://jvn.jp/en/jp/JVN41452671/index.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://eset-support.canon-its.jp/faq/show/10720?site_domain=default"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vultures@jpcert.or.jp",
"ID": "CVE-2018-0649",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "The installers of multiple Canon IT Solutions Inc. software programs",
"version": {
"version_data": [
{
"version_value": "(ESET Smart Security Premium, ESET Internet Security, ESET Smart Security, ESET NOD32 Antivirus, DESlock+ Pro, and CompuSec (all programs except packaged ones))"
}
]
}
}
]
},
"vendor_name": "Canon IT Solutions Inc."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Untrusted search path vulnerability in the installers of multiple Canon IT Solutions Inc. software programs (ESET Smart Security Premium, ESET Internet Security, ESET Smart Security, ESET NOD32 Antivirus, DESlock+ Pro, and CompuSec (all programs except packaged ones)) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Untrusted search path vulnerability"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "JVN#41452671",
"refsource": "JVN",
"url": "http://jvn.jp/en/jp/JVN41452671/index.html"
},
{
"name": "https://eset-support.canon-its.jp/faq/show/10720?site_domain=default",
"refsource": "CONFIRM",
"url": "https://eset-support.canon-its.jp/faq/show/10720?site_domain=default"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2018-0649",
"datePublished": "2018-09-07T14:00:00.000Z",
"dateReserved": "2017-11-27T00:00:00.000Z",
"dateUpdated": "2024-08-05T03:35:48.946Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}