Vulnerability-Lookup

CVE-2021-37852 (GCVE-0-2021-37852)

Vulnerability from cvelistv5 – Published: 2022-02-09 05:14 – Updated: 2024-09-16 23:02

Title

LPE in ESET products for Windows

Summary

ESET products for Windows allows untrusted process to impersonate the client of a pipe, which can be leveraged by attacker to escalate privileges in the context of NT AUTHORITY\SYSTEM.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

Privilege Escalation

Assigner

ESET CNA under the ENISA root

CNA scorecard – unranked: 7 records in the last 180 days, 10 needed details

References

2 references

URL	Tags
https://support.eset.com/en/ca8223-local-privileg…	x_refsource_MISC
https://www.zerodayinitiative.com/advisories/ZDI-…	x_refsource_MISC

Impacted products

11 products

Vendor	Product	Version	CPE status
ESET	ESET NOD32 Antivirus	Affected: 10.0.337.1 , ≤ 15.0.18.0 (custom)	guessed
ESET	ESET Internet Security	Affected: 10.0.337.1 , ≤ 15.0.18.0 (custom)	guessed
ESET	ESET Smart Security	Affected: 10.0.337.1 , ≤ 15.0.18.0 (custom)	guessed
ESET	ESET Endpoint Antivirus for Windows	Affected: 6.6.2046.0 , ≤ 9.0.2032.4 (custom)	guessed
ESET	ESET Endpoint Security for Windows	Affected: 6.6.2046.0 , ≤ 9.0.2032.4 (custom)	guessed
ESET	ESET Server Security for Microsoft Windows Server	Affected: 8.0.12003.0 , ≤ 8.0.12003.1 (custom)	guessed
ESET	ESET File Security for Microsoft Windows Server	Affected: 7.0.12014.0 , ≤ 7.3.12006.0 (custom)	guessed
ESET	ESET Server Security for Microsoft Azure	Affected: 7.0.12016.1002 , ≤ 7.2.12004.1000 (custom)	guessed
ESET	ESET Security for Microsoft SharePoint Server	Affected: 7.0.15008.0 , ≤ 8.0.15004.0 (custom)	guessed
ESET	ESET Mail Security for IBM Domino	Affected: 7.0.14008.0 , ≤ 8.0.14004.0 (custom)	guessed
ESET	ESET Mail Security for Microsoft Exchange Server	Affected: 7.0.10019 , ≤ 8.0.10016.0 (custom)	guessed

Date Public

2022-01-31 00:00

Credits

Michael DePlante (@izobashi) of Trend Micro's Zero Day Initiative

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T01:30:09.085Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://support.eset.com/en/ca8223-local-privilege-escalation-vulnerability-fixed-in-eset-products-for-windows"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.zerodayinitiative.com/advisories/ZDI-22-148/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ESET NOD32 Antivirus",
          "vendor": "ESET",
          "versions": [
            {
              "lessThanOrEqual": "15.0.18.0",
              "status": "affected",
              "version": "10.0.337.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "ESET Internet Security",
          "vendor": "ESET",
          "versions": [
            {
              "lessThanOrEqual": "15.0.18.0",
              "status": "affected",
              "version": "10.0.337.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "ESET Smart Security",
          "vendor": "ESET",
          "versions": [
            {
              "lessThanOrEqual": "15.0.18.0",
              "status": "affected",
              "version": "10.0.337.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "ESET Endpoint Antivirus for Windows",
          "vendor": "ESET",
          "versions": [
            {
              "lessThanOrEqual": "9.0.2032.4",
              "status": "affected",
              "version": "6.6.2046.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "ESET Endpoint Security for Windows",
          "vendor": "ESET",
          "versions": [
            {
              "lessThanOrEqual": "9.0.2032.4",
              "status": "affected",
              "version": "6.6.2046.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "ESET Server Security for Microsoft Windows Server",
          "vendor": "ESET",
          "versions": [
            {
              "lessThanOrEqual": "8.0.12003.1",
              "status": "affected",
              "version": "8.0.12003.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "ESET File Security for Microsoft Windows Server",
          "vendor": "ESET",
          "versions": [
            {
              "lessThanOrEqual": "7.3.12006.0",
              "status": "affected",
              "version": "7.0.12014.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "ESET Server Security for Microsoft Azure",
          "vendor": "ESET",
          "versions": [
            {
              "lessThanOrEqual": "7.2.12004.1000",
              "status": "affected",
              "version": "7.0.12016.1002",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "ESET Security for Microsoft SharePoint Server",
          "vendor": "ESET",
          "versions": [
            {
              "lessThanOrEqual": "8.0.15004.0",
              "status": "affected",
              "version": "7.0.15008.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "ESET Mail Security for IBM Domino",
          "vendor": "ESET",
          "versions": [
            {
              "lessThanOrEqual": "8.0.14004.0",
              "status": "affected",
              "version": "7.0.14008.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "ESET Mail Security for Microsoft Exchange Server",
          "vendor": "ESET",
          "versions": [
            {
              "lessThanOrEqual": "8.0.10016.0",
              "status": "affected",
              "version": "7.0.10019",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Michael DePlante (@izobashi) of Trend Micro\u0027s Zero Day Initiative"
        }
      ],
      "datePublic": "2022-01-31T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "ESET products for Windows allows untrusted process to impersonate the client of a pipe, which can be leveraged by attacker to escalate privileges in the context of NT AUTHORITY\\SYSTEM."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Privilege Escalation",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-02-09T05:14:13.000Z",
        "orgId": "4a9b9929-2450-4021-b7b9-469a0255b215",
        "shortName": "ESET"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://support.eset.com/en/ca8223-local-privilege-escalation-vulnerability-fixed-in-eset-products-for-windows"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-22-148/"
        }
      ],
      "source": {
        "advisory": "CA8223",
        "discovery": "EXTERNAL"
      },
      "title": "LPE in ESET products for Windows",
      "workarounds": [
        {
          "lang": "en",
          "value": "The attack surface can also be eliminated by disabling the Enable advanced scanning via AMSI option in ESET products\u00e2\u20ac\u2122 Advanced setup.\n\nHowever, ESET strongly recommends performing an upgrade to a fixed product version and only applying this workaround when the upgrade is not possible for an important reason."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@eset.com",
          "DATE_PUBLIC": "2022-01-31T09:00:00.000Z",
          "ID": "CVE-2021-37852",
          "STATE": "PUBLIC",
          "TITLE": "LPE in ESET products for Windows"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "ESET NOD32 Antivirus",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "10.0.337.1",
                            "version_value": "15.0.18.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "ESET Internet Security",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "10.0.337.1",
                            "version_value": "15.0.18.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "ESET Smart Security",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "10.0.337.1",
                            "version_value": "15.0.18.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "ESET Endpoint Antivirus for Windows",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "6.6.2046.0",
                            "version_value": "9.0.2032.4"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "ESET Endpoint Security for Windows",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "6.6.2046.0",
                            "version_value": "9.0.2032.4"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "ESET Server Security for Microsoft Windows Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "8.0.12003.0",
                            "version_value": "8.0.12003.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "ESET File Security for Microsoft Windows Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "7.0.12014.0",
                            "version_value": "7.3.12006.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "ESET Server Security for Microsoft Azure",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "7.0.12016.1002",
                            "version_value": "7.2.12004.1000"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "ESET Security for Microsoft SharePoint Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "7.0.15008.0",
                            "version_value": "8.0.15004.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "ESET Mail Security for IBM Domino",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "7.0.14008.0",
                            "version_value": "8.0.14004.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "ESET Mail Security for Microsoft Exchange Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "7.0.10019",
                            "version_value": "8.0.10016.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "ESET"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Michael DePlante (@izobashi) of Trend Micro\u0027s Zero Day Initiative"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "ESET products for Windows allows untrusted process to impersonate the client of a pipe, which can be leveraged by attacker to escalate privileges in the context of NT AUTHORITY\\SYSTEM."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Privilege Escalation"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://support.eset.com/en/ca8223-local-privilege-escalation-vulnerability-fixed-in-eset-products-for-windows",
              "refsource": "MISC",
              "url": "https://support.eset.com/en/ca8223-local-privilege-escalation-vulnerability-fixed-in-eset-products-for-windows"
            },
            {
              "name": "https://www.zerodayinitiative.com/advisories/ZDI-22-148/",
              "refsource": "MISC",
              "url": "https://www.zerodayinitiative.com/advisories/ZDI-22-148/"
            }
          ]
        },
        "source": {
          "advisory": "CA8223",
          "discovery": "EXTERNAL"
        },
        "work_around": [
          {
            "lang": "en",
            "value": "The attack surface can also be eliminated by disabling the Enable advanced scanning via AMSI option in ESET products\u00e2\u20ac\u2122 Advanced setup.\n\nHowever, ESET strongly recommends performing an upgrade to a fixed product version and only applying this workaround when the upgrade is not possible for an important reason."
          }
        ]
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4a9b9929-2450-4021-b7b9-469a0255b215",
    "assignerShortName": "ESET",
    "cveId": "CVE-2021-37852",
    "datePublished": "2022-02-09T05:14:13.627Z",
    "dateReserved": "2021-08-02T00:00:00.000Z",
    "dateUpdated": "2024-09-16T23:02:00.516Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-37852",
      "date": "2026-11-01",
      "epss": "0.00599",
      "percentile": "0.48677"
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:eset:endpoint_antivirus:*:*:*:*:*:windows:*:*",
                    "matchCriteriaId": "0D494F17-5B37-44D5-B479-BCEC4F9D9921",
                    "versionEndExcluding": "7.3.2055.0",
                    "versionStartIncluding": "6.6.2046.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:eset:endpoint_antivirus:*:*:*:*:*:windows:*:*",
                    "matchCriteriaId": "638E5789-809F-475C-8B3D-E33C5EA92B1F",
                    "versionEndExcluding": "8.0.2028.3",
                    "versionStartIncluding": "8.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:eset:endpoint_antivirus:*:*:*:*:*:windows:*:*",
                    "matchCriteriaId": "74F5AF0F-9CE2-4CAD-A313-DCEA350CF8AB",
                    "versionEndExcluding": "8.1.2031.4",
                    "versionStartIncluding": "8.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:eset:endpoint_antivirus:*:*:*:*:*:windows:*:*",
                    "matchCriteriaId": "4DE8CF7C-1C9C-448A-83AD-6659CA610C3E",
                    "versionEndExcluding": "9.0.2032.6",
                    "versionStartIncluding": "9.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:eset:endpoint_security:*:*:*:*:*:windows:*:*",
                    "matchCriteriaId": "33CA36F6-CE4D-4E1B-B5EC-D21DF39DFFE5",
                    "versionEndExcluding": "7.3.2055.0",
                    "versionStartIncluding": "6.6.2046.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:eset:endpoint_security:*:*:*:*:*:windows:*:*",
                    "matchCriteriaId": "0C2C253F-7980-43CE-8E5F-40779DBD8D88",
                    "versionEndExcluding": "8.0.2028.3",
                    "versionStartIncluding": "8.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:eset:endpoint_security:*:*:*:*:*:windows:*:*",
                    "matchCriteriaId": "AF09B28D-D422-4028-8A31-2F55F131A69F",
                    "versionEndExcluding": "8.1.2031.4",
                    "versionStartIncluding": "8.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:eset:endpoint_security:*:*:*:*:*:windows:*:*",
                    "matchCriteriaId": "3AAD4B6F-6B42-498E-A076-732874709B7F",
                    "versionEndExcluding": "9.0.2032.6",
                    "versionStartIncluding": "9.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:eset:file_security:*:*:*:*:*:windows_server:*:*",
                    "matchCriteriaId": "E210C3F1-0F2E-459D-879E-E6B086498064",
                    "versionEndIncluding": "7.3.12006.0",
                    "versionStartIncluding": "7.0.12014.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:eset:internet_security:*:*:*:*:*:windows:*:*",
                    "matchCriteriaId": "7F7996D3-D9B9-42F2-B72E-76A469982678",
                    "versionEndExcluding": "15.0.18.0",
                    "versionStartIncluding": "10.0.337.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:eset:mail_security:*:*:*:*:*:exchange_server:*:*",
                    "matchCriteriaId": "5C50B379-3966-4EAD-B7B9-D947F579C16E",
                    "versionEndExcluding": "7.3.10014.0",
                    "versionStartIncluding": "7.0.10019",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:eset:mail_security:*:*:*:*:*:domino:*:*",
                    "matchCriteriaId": "64635AFE-0951-45D7-80B9-3D9CD184B14C",
                    "versionEndExcluding": "7.3.14003.0",
                    "versionStartIncluding": "7.0.14008.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:eset:mail_security:*:*:*:*:*:domino:*:*",
                    "matchCriteriaId": "5D129FDA-4840-4BE6-89CA-CB36A21A9BE9",
                    "versionEndExcluding": "8.0.14006.0",
                    "versionStartIncluding": "8.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:eset:mail_security:*:*:*:*:*:exchange_server:*:*",
                    "matchCriteriaId": "63812015-CAD8-433A-B3CC-58D397793646",
                    "versionEndExcluding": "8.0.10018.0",
                    "versionStartIncluding": "8.0.10012.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:eset:nod32_antivirus:*:*:*:*:*:windows:*:*",
                    "matchCriteriaId": "D8E297F9-0DAB-4EE5-A8E6-DFE7B2234AC2",
                    "versionEndIncluding": "15.0.18.0",
                    "versionStartIncluding": "10.0.337.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:eset:security:*:*:*:*:*:sharepoint:*:*",
                    "matchCriteriaId": "4894CF51-27CF-4EB1-B898-04BBBCD45CCA",
                    "versionEndIncluding": "8.0.15004.0",
                    "versionStartIncluding": "7.0.15008.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:eset:server_security:*:*:*:*:azure:*:*:*",
                    "matchCriteriaId": "309C9C05-EC2A-4B45-A912-07DA47A6C65C",
                    "versionEndIncluding": "7.2.12004.1000",
                    "versionStartIncluding": "7.0.12016.1002",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:eset:server_security:8.0.12003.0:*:*:*:*:windows_server:*:*",
                    "matchCriteriaId": "2A6490D2-AA1D-4063-93FA-54A7C3701904",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:eset:server_security:8.0.12003.1:*:*:*:*:windows_server:*:*",
                    "matchCriteriaId": "242158EE-6A39-4A03-B618-B025645E30EB",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:eset:smart_security:*:*:*:*:-:windows:*:*",
                    "matchCriteriaId": "8FA2888F-C7F3-4F98-B961-9887F821B780",
                    "versionEndIncluding": "15.0.18.0",
                    "versionStartIncluding": "10.0.337.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:eset:smart_security:*:*:*:*:premium:windows:*:*",
                    "matchCriteriaId": "18E4245E-D7AB-4496-931E-9A96A946241B",
                    "versionEndIncluding": "15.0.18.0",
                    "versionStartIncluding": "10.0.337.1",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "ESET products for Windows allows untrusted process to impersonate the client of a pipe, which can be leveraged by attacker to escalate privileges in the context of NT AUTHORITY\\SYSTEM."
          },
          {
            "lang": "es",
            "value": "Los productos de ESET para Windows permiten a un proceso no confiable hacerse pasar por el cliente de una tuber\u00eda, lo que puede ser aprovechado por un atacante para escalar privilegios en el contexto de NT AUTHORITY\\SYSTEM"
          }
        ],
        "id": "CVE-2021-37852",
        "lastModified": "2024-11-21T06:15:58.793",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "HIGH",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "LOCAL",
                "authentication": "NONE",
                "availabilityImpact": "COMPLETE",
                "baseScore": 7.2,
                "confidentialityImpact": "COMPLETE",
                "integrityImpact": "COMPLETE",
                "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
                "version": "2.0"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 10.0,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "security@eset.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2022-02-09T06:15:06.990",
        "references": [
          {
            "source": "security@eset.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://support.eset.com/en/ca8223-local-privilege-escalation-vulnerability-fixed-in-eset-products-for-windows"
          },
          {
            "source": "security@eset.com",
            "tags": [
              "Third Party Advisory",
              "VDB Entry"
            ],
            "url": "https://www.zerodayinitiative.com/advisories/ZDI-22-148/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://support.eset.com/en/ca8223-local-privilege-escalation-vulnerability-fixed-in-eset-products-for-windows"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory",
              "VDB Entry"
            ],
            "url": "https://www.zerodayinitiative.com/advisories/ZDI-22-148/"
          }
        ],
        "sourceIdentifier": "security@eset.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-269"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-03-27T13:44:13+00:00",
      "cve": "CVE-2021-37852",
      "id": "CVE-2021-37852",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "LPE in ESET products for Windows",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-37852.json",
      "version": "3"
    }
  }
}

CERTFR-2022-AVI-095

Vulnerability from certfr_avis - Published: 2022-01-31 - Updated: 2022-01-31

Une vulnérabilité a été découverte dans les produits ESET. Elle permet à un attaquant de provoquer une élévation de privilèges.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctif (cf. section Documentation).

Contournement provisoire

L'éditeur propose une mesure de contournement si l'installation des correctifs n'est pas envisageable (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
ESET	Security	ESET Security for Microsoft SharePoint Server versions antérieures à 8.0.15006.0 (mise à jour du 16 décembre 2021)
ESET	Security	ESET Security for Microsoft SharePoint Server versions antérieures à 7.3.15002.0 (mise à jour du 12 janvier 2022)
ESET	Mail Security	ESET Mail Security for IBM Domino versions antérieures à 7.3.14003.0 (mise à jour du 26 janvier 2022)
ESET	N/A	ESET Endpoint Antivirus for Windows et ESET Endpoint Security for Windows versions antérieures à 8.0.2028.3, 8.0.2028.4, 8.0.2039.3, 8.0.2039.4, 8.0.2044.3, 8.0.2044.4, 8.1.2031.3, 8.1.2031.4, 8.1.2037.9 et 8.1.2037.10 (mise à jour du 25 janvier 2022)
ESET	N/A	ESET Endpoint Antivirus for Windows et ESET Endpoint Security for Windows versions antérieures à 7.3.2055.0 et 7.3.2055.1 (mise à jour du 31 janvier 2022)
ESET	File Security	ESET File Security for Microsoft Windows Server versions antérieures à 7.3.12008.0 (mise à jour du 12 janvier 2022)
ESET	N/A	ESET NOD32 Antivirus, ESET Internet Security, ESET Smart Security et ESET Smart Security versiosn antérieures à 15.0.19.0 (mise à jour du 8 décembre 2021)
ESET	Server Security	ESET Server Security for Microsoft Windows Server versions antérieures à 8.0.12010.0 (mise à jour du 16 décembre 2021)
ESET	Mail Security	ESET Mail Security for IBM Domino versions antérieures à 8.0.14006.0 (mise à jour du 16 décembre 2021)
ESET	Mail Security	ESET Mail Security for Microsoft Exchange Server versions antérieures à 7.3.10014.0 (mise à jour du 26 janvier 2022)
ESET	N/A	ESET Endpoint Antivirus for Windows et ESET Endpoint Security for Windows versions antérieures à 9.0.2032.6 et 9.0.2032.7 (mise à jour du 16 décembre 2021)
ESET	Mail Security	ESET Mail Security for Microsoft Exchange Server versions antérieures à 8.0.10018.0 (mise à jour du 16 décembre 2021)

References

Title

Publication Time

FKIE_CVE-2021-37852

Vulnerability from fkie_nvd - Published: 2022-02-09 06:15 - Updated: 2026-06-17 04:01

Severity

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

ESET products for Windows allows untrusted process to impersonate the client of a pipe, which can be leveraged by attacker to escalate privileges in the context of NT AUTHORITY\SYSTEM.

References

URL	Tags
security@eset.com	https://support.eset.com/en/ca8223-local-privilege-escalation-vulnerability-fixed-in-eset-products-for-windows	Vendor Advisory
security@eset.com	https://www.zerodayinitiative.com/advisories/ZDI-22-148/	Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108	https://support.eset.com/en/ca8223-local-privilege-escalation-vulnerability-fixed-in-eset-products-for-windows	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.zerodayinitiative.com/advisories/ZDI-22-148/	Third Party Advisory, VDB Entry

Impacted products

Vendor	Product	Version
eset	endpoint_antivirus	*
eset	endpoint_antivirus	*
eset	endpoint_antivirus	*
eset	endpoint_antivirus	*
eset	endpoint_security	*
eset	endpoint_security	*
eset	endpoint_security	*
eset	endpoint_security	*
eset	file_security	*
eset	internet_security	*
eset	mail_security	*
eset	mail_security	*
eset	mail_security	*
eset	mail_security	*
eset	nod32_antivirus	*
eset	security	*
eset	server_security	*
eset	server_security	8.0.12003.0
eset	server_security	8.0.12003.1
eset	smart_security	*
eset	smart_security	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "ESET NOD32 Antivirus",
          "vendor": "ESET",
          "versions": [
            {
              "lessThanOrEqual": "15.0.18.0",
              "status": "affected",
              "version": "10.0.337.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "ESET Internet Security",
          "vendor": "ESET",
          "versions": [
            {
              "lessThanOrEqual": "15.0.18.0",
              "status": "affected",
              "version": "10.0.337.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "ESET Smart Security",
          "vendor": "ESET",
          "versions": [
            {
              "lessThanOrEqual": "15.0.18.0",
              "status": "affected",
              "version": "10.0.337.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "ESET Endpoint Antivirus for Windows",
          "vendor": "ESET",
          "versions": [
            {
              "lessThanOrEqual": "9.0.2032.4",
              "status": "affected",
              "version": "6.6.2046.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "ESET Endpoint Security for Windows",
          "vendor": "ESET",
          "versions": [
            {
              "lessThanOrEqual": "9.0.2032.4",
              "status": "affected",
              "version": "6.6.2046.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "ESET Server Security for Microsoft Windows Server",
          "vendor": "ESET",
          "versions": [
            {
              "lessThanOrEqual": "8.0.12003.1",
              "status": "affected",
              "version": "8.0.12003.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "ESET File Security for Microsoft Windows Server",
          "vendor": "ESET",
          "versions": [
            {
              "lessThanOrEqual": "7.3.12006.0",
              "status": "affected",
              "version": "7.0.12014.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "ESET Server Security for Microsoft Azure",
          "vendor": "ESET",
          "versions": [
            {
              "lessThanOrEqual": "7.2.12004.1000",
              "status": "affected",
              "version": "7.0.12016.1002",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "ESET Security for Microsoft SharePoint Server",
          "vendor": "ESET",
          "versions": [
            {
              "lessThanOrEqual": "8.0.15004.0",
              "status": "affected",
              "version": "7.0.15008.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "ESET Mail Security for IBM Domino",
          "vendor": "ESET",
          "versions": [
            {
              "lessThanOrEqual": "8.0.14004.0",
              "status": "affected",
              "version": "7.0.14008.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "ESET Mail Security for Microsoft Exchange Server",
          "vendor": "ESET",
          "versions": [
            {
              "lessThanOrEqual": "8.0.10016.0",
              "status": "affected",
              "version": "7.0.10019",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "security@eset.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:eset:endpoint_antivirus:*:*:*:*:*:windows:*:*",
              "matchCriteriaId": "0D494F17-5B37-44D5-B479-BCEC4F9D9921",
              "versionEndExcluding": "7.3.2055.0",
              "versionStartIncluding": "6.6.2046.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:eset:endpoint_antivirus:*:*:*:*:*:windows:*:*",
              "matchCriteriaId": "638E5789-809F-475C-8B3D-E33C5EA92B1F",
              "versionEndExcluding": "8.0.2028.3",
              "versionStartIncluding": "8.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:eset:endpoint_antivirus:*:*:*:*:*:windows:*:*",
              "matchCriteriaId": "74F5AF0F-9CE2-4CAD-A313-DCEA350CF8AB",
              "versionEndExcluding": "8.1.2031.4",
              "versionStartIncluding": "8.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:eset:endpoint_antivirus:*:*:*:*:*:windows:*:*",
              "matchCriteriaId": "4DE8CF7C-1C9C-448A-83AD-6659CA610C3E",
              "versionEndExcluding": "9.0.2032.6",
              "versionStartIncluding": "9.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:eset:endpoint_security:*:*:*:*:*:windows:*:*",
              "matchCriteriaId": "33CA36F6-CE4D-4E1B-B5EC-D21DF39DFFE5",
              "versionEndExcluding": "7.3.2055.0",
              "versionStartIncluding": "6.6.2046.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:eset:endpoint_security:*:*:*:*:*:windows:*:*",
              "matchCriteriaId": "0C2C253F-7980-43CE-8E5F-40779DBD8D88",
              "versionEndExcluding": "8.0.2028.3",
              "versionStartIncluding": "8.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:eset:endpoint_security:*:*:*:*:*:windows:*:*",
              "matchCriteriaId": "AF09B28D-D422-4028-8A31-2F55F131A69F",
              "versionEndExcluding": "8.1.2031.4",
              "versionStartIncluding": "8.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:eset:endpoint_security:*:*:*:*:*:windows:*:*",
              "matchCriteriaId": "3AAD4B6F-6B42-498E-A076-732874709B7F",
              "versionEndExcluding": "9.0.2032.6",
              "versionStartIncluding": "9.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:eset:file_security:*:*:*:*:*:windows_server:*:*",
              "matchCriteriaId": "E210C3F1-0F2E-459D-879E-E6B086498064",
              "versionEndIncluding": "7.3.12006.0",
              "versionStartIncluding": "7.0.12014.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:eset:internet_security:*:*:*:*:*:windows:*:*",
              "matchCriteriaId": "7F7996D3-D9B9-42F2-B72E-76A469982678",
              "versionEndExcluding": "15.0.18.0",
              "versionStartIncluding": "10.0.337.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:eset:mail_security:*:*:*:*:*:exchange_server:*:*",
              "matchCriteriaId": "5C50B379-3966-4EAD-B7B9-D947F579C16E",
              "versionEndExcluding": "7.3.10014.0",
              "versionStartIncluding": "7.0.10019",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:eset:mail_security:*:*:*:*:*:domino:*:*",
              "matchCriteriaId": "64635AFE-0951-45D7-80B9-3D9CD184B14C",
              "versionEndExcluding": "7.3.14003.0",
              "versionStartIncluding": "7.0.14008.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:eset:mail_security:*:*:*:*:*:domino:*:*",
              "matchCriteriaId": "5D129FDA-4840-4BE6-89CA-CB36A21A9BE9",
              "versionEndExcluding": "8.0.14006.0",
              "versionStartIncluding": "8.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:eset:mail_security:*:*:*:*:*:exchange_server:*:*",
              "matchCriteriaId": "63812015-CAD8-433A-B3CC-58D397793646",
              "versionEndExcluding": "8.0.10018.0",
              "versionStartIncluding": "8.0.10012.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:eset:nod32_antivirus:*:*:*:*:*:windows:*:*",
              "matchCriteriaId": "D8E297F9-0DAB-4EE5-A8E6-DFE7B2234AC2",
              "versionEndIncluding": "15.0.18.0",
              "versionStartIncluding": "10.0.337.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:eset:security:*:*:*:*:*:sharepoint:*:*",
              "matchCriteriaId": "4894CF51-27CF-4EB1-B898-04BBBCD45CCA",
              "versionEndIncluding": "8.0.15004.0",
              "versionStartIncluding": "7.0.15008.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:eset:server_security:*:*:*:*:azure:*:*:*",
              "matchCriteriaId": "309C9C05-EC2A-4B45-A912-07DA47A6C65C",
              "versionEndIncluding": "7.2.12004.1000",
              "versionStartIncluding": "7.0.12016.1002",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:eset:server_security:8.0.12003.0:*:*:*:*:windows_server:*:*",
              "matchCriteriaId": "2A6490D2-AA1D-4063-93FA-54A7C3701904",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:eset:server_security:8.0.12003.1:*:*:*:*:windows_server:*:*",
              "matchCriteriaId": "242158EE-6A39-4A03-B618-B025645E30EB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:eset:smart_security:*:*:*:*:-:windows:*:*",
              "matchCriteriaId": "8FA2888F-C7F3-4F98-B961-9887F821B780",
              "versionEndIncluding": "15.0.18.0",
              "versionStartIncluding": "10.0.337.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:eset:smart_security:*:*:*:*:premium:windows:*:*",
              "matchCriteriaId": "18E4245E-D7AB-4496-931E-9A96A946241B",
              "versionEndIncluding": "15.0.18.0",
              "versionStartIncluding": "10.0.337.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ESET products for Windows allows untrusted process to impersonate the client of a pipe, which can be leveraged by attacker to escalate privileges in the context of NT AUTHORITY\\SYSTEM."
    },
    {
      "lang": "es",
      "value": "Los productos de ESET para Windows permiten a un proceso no confiable hacerse pasar por el cliente de una tuber\u00eda, lo que puede ser aprovechado por un atacante para escalar privilegios en el contexto de NT AUTHORITY\\SYSTEM"
    }
  ],
  "id": "CVE-2021-37852",
  "lastModified": "2026-06-17T04:01:12.383",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 7.2,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "security@eset.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-02-09T06:15:06.990",
  "references": [
    {
      "source": "security@eset.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://support.eset.com/en/ca8223-local-privilege-escalation-vulnerability-fixed-in-eset-products-for-windows"
    },
    {
      "source": "security@eset.com",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-22-148/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://support.eset.com/en/ca8223-local-privilege-escalation-vulnerability-fixed-in-eset-products-for-windows"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-22-148/"
    }
  ],
  "sourceIdentifier": "security@eset.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-GJ8G-JFXX-VXC7

Vulnerability from github – Published: 2022-02-10 00:00 – Updated: 2022-02-12 00:01

Details

ESET products for Windows allows untrusted process to impersonate the client of a pipe, which can be leveraged by attacker to escalate privileges in the context of NT AUTHORITY\SYSTEM.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2021-37852"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-02-09T06:15:00Z",
    "severity": "HIGH"
  },
  "details": "ESET products for Windows allows untrusted process to impersonate the client of a pipe, which can be leveraged by attacker to escalate privileges in the context of NT AUTHORITY\\SYSTEM.",
  "id": "GHSA-gj8g-jfxx-vxc7",
  "modified": "2022-02-12T00:01:02Z",
  "published": "2022-02-10T00:00:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37852"
    },
    {
      "type": "WEB",
      "url": "https://support.eset.com/en/ca8223-local-privilege-escalation-vulnerability-fixed-in-eset-products-for-windows"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-22-148"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GSD-2021-37852

Vulnerability from gsd - Updated: 2023-12-13 01:23

Details

ESET products for Windows allows untrusted process to impersonate the client of a pipe, which can be leveraged by attacker to escalate privileges in the context of NT AUTHORITY\SYSTEM.

Aliases

CVE-2021-37852

Aliases

CVE-2021-37852

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2021-37852",
    "description": "ESET products for Windows allows untrusted process to impersonate the client of a pipe, which can be leveraged by attacker to escalate privileges in the context of NT AUTHORITY\\SYSTEM.",
    "id": "GSD-2021-37852"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2021-37852"
      ],
      "details": "ESET products for Windows allows untrusted process to impersonate the client of a pipe, which can be leveraged by attacker to escalate privileges in the context of NT AUTHORITY\\SYSTEM.",
      "id": "GSD-2021-37852",
      "modified": "2023-12-13T01:23:10.098941Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security@eset.com",
        "DATE_PUBLIC": "2022-01-31T09:00:00.000Z",
        "ID": "CVE-2021-37852",
        "STATE": "PUBLIC",
        "TITLE": "LPE in ESET products for Windows"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "ESET NOD32 Antivirus",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c=",
                          "version_name": "10.0.337.1",
                          "version_value": "15.0.18.0"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "ESET Internet Security",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c=",
                          "version_name": "10.0.337.1",
                          "version_value": "15.0.18.0"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "ESET Smart Security",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c=",
                          "version_name": "10.0.337.1",
                          "version_value": "15.0.18.0"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "ESET Endpoint Antivirus for Windows",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c=",
                          "version_name": "6.6.2046.0",
                          "version_value": "9.0.2032.4"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "ESET Endpoint Security for Windows",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c=",
                          "version_name": "6.6.2046.0",
                          "version_value": "9.0.2032.4"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "ESET Server Security for Microsoft Windows Server",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c=",
                          "version_name": "8.0.12003.0",
                          "version_value": "8.0.12003.1"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "ESET File Security for Microsoft Windows Server",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.0.12014.0",
                          "version_value": "7.3.12006.0"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "ESET Server Security for Microsoft Azure",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.0.12016.1002",
                          "version_value": "7.2.12004.1000"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "ESET Security for Microsoft SharePoint Server",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.0.15008.0",
                          "version_value": "8.0.15004.0"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "ESET Mail Security for IBM Domino",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.0.14008.0",
                          "version_value": "8.0.14004.0"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "ESET Mail Security for Microsoft Exchange Server",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.0.10019",
                          "version_value": "8.0.10016.0"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "ESET"
            }
          ]
        }
      },
      "credit": [
        {
          "lang": "eng",
          "value": "Michael DePlante (@izobashi) of Trend Micro\u0027s Zero Day Initiative"
        }
      ],
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "ESET products for Windows allows untrusted process to impersonate the client of a pipe, which can be leveraged by attacker to escalate privileges in the context of NT AUTHORITY\\SYSTEM."
          }
        ]
      },
      "generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "impact": {
        "cvss": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Privilege Escalation"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://support.eset.com/en/ca8223-local-privilege-escalation-vulnerability-fixed-in-eset-products-for-windows",
            "refsource": "MISC",
            "url": "https://support.eset.com/en/ca8223-local-privilege-escalation-vulnerability-fixed-in-eset-products-for-windows"
          },
          {
            "name": "https://www.zerodayinitiative.com/advisories/ZDI-22-148/",
            "refsource": "MISC",
            "url": "https://www.zerodayinitiative.com/advisories/ZDI-22-148/"
          }
        ]
      },
      "source": {
        "advisory": "CA8223",
        "discovery": "EXTERNAL"
      },
      "work_around": [
        {
          "lang": "eng",
          "value": "The attack surface can also be eliminated by disabling the Enable advanced scanning via AMSI option in ESET products\u00e2\u20ac\u2122 Advanced setup.\n\nHowever, ESET strongly recommends performing an upgrade to a fixed product version and only applying this workaround when the upgrade is not possible for an important reason."
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:eset:mail_security:*:*:*:*:*:domino:*:*",
                "cpe_name": [],
                "versionEndExcluding": "8.0.14006.0",
                "versionStartIncluding": "8.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:eset:mail_security:*:*:*:*:*:domino:*:*",
                "cpe_name": [],
                "versionEndExcluding": "7.3.14003.0",
                "versionStartIncluding": "7.0.14008.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:eset:mail_security:*:*:*:*:*:exchange_server:*:*",
                "cpe_name": [],
                "versionEndExcluding": "8.0.10018.0",
                "versionStartIncluding": "8.0.10012.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:eset:mail_security:*:*:*:*:*:exchange_server:*:*",
                "cpe_name": [],
                "versionEndExcluding": "7.3.10014.0",
                "versionStartIncluding": "7.0.10019",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:eset:internet_security:*:*:*:*:*:windows:*:*",
                "cpe_name": [],
                "versionEndExcluding": "15.0.18.0",
                "versionStartIncluding": "10.0.337.1",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:eset:endpoint_security:*:*:*:*:*:windows:*:*",
                "cpe_name": [],
                "versionEndExcluding": "9.0.2032.6",
                "versionStartIncluding": "9.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:eset:endpoint_security:*:*:*:*:*:windows:*:*",
                "cpe_name": [],
                "versionEndExcluding": "8.1.2031.4",
                "versionStartIncluding": "8.1",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:eset:endpoint_security:*:*:*:*:*:windows:*:*",
                "cpe_name": [],
                "versionEndExcluding": "8.0.2028.3",
                "versionStartIncluding": "8.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:eset:endpoint_security:*:*:*:*:*:windows:*:*",
                "cpe_name": [],
                "versionEndExcluding": "7.3.2055.0",
                "versionStartIncluding": "6.6.2046.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:eset:endpoint_antivirus:*:*:*:*:*:windows:*:*",
                "cpe_name": [],
                "versionEndExcluding": "7.3.2055.0",
                "versionStartIncluding": "6.6.2046.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:eset:endpoint_antivirus:*:*:*:*:*:windows:*:*",
                "cpe_name": [],
                "versionEndExcluding": "8.0.2028.3",
                "versionStartIncluding": "8.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:eset:endpoint_antivirus:*:*:*:*:*:windows:*:*",
                "cpe_name": [],
                "versionEndExcluding": "8.1.2031.4",
                "versionStartIncluding": "8.1",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:eset:endpoint_antivirus:*:*:*:*:*:windows:*:*",
                "cpe_name": [],
                "versionEndExcluding": "9.0.2032.6",
                "versionStartIncluding": "9.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:eset:file_security:*:*:*:*:*:windows_server:*:*",
                "cpe_name": [],
                "versionEndIncluding": "7.3.12006.0",
                "versionStartIncluding": "7.0.12014.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:eset:nod32_antivirus:*:*:*:*:*:windows:*:*",
                "cpe_name": [],
                "versionEndIncluding": "15.0.18.0",
                "versionStartIncluding": "10.0.337.1",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:eset:security:*:*:*:*:*:sharepoint:*:*",
                "cpe_name": [],
                "versionEndIncluding": "8.0.15004.0",
                "versionStartIncluding": "7.0.15008.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:eset:server_security:*:*:*:*:azure:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "7.2.12004.1000",
                "versionStartIncluding": "7.0.12016.1002",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:eset:server_security:8.0.12003.0:*:*:*:*:windows_server:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:eset:server_security:8.0.12003.1:*:*:*:*:windows_server:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:eset:smart_security:*:*:*:*:-:windows:*:*",
                "cpe_name": [],
                "versionEndIncluding": "15.0.18.0",
                "versionStartIncluding": "10.0.337.1",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:eset:smart_security:*:*:*:*:premium:windows:*:*",
                "cpe_name": [],
                "versionEndIncluding": "15.0.18.0",
                "versionStartIncluding": "10.0.337.1",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security@eset.com",
          "ID": "CVE-2021-37852"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "ESET products for Windows allows untrusted process to impersonate the client of a pipe, which can be leveraged by attacker to escalate privileges in the context of NT AUTHORITY\\SYSTEM."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-863"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.zerodayinitiative.com/advisories/ZDI-22-148/",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "https://www.zerodayinitiative.com/advisories/ZDI-22-148/"
            },
            {
              "name": "https://support.eset.com/en/ca8223-local-privilege-escalation-vulnerability-fixed-in-eset-products-for-windows",
              "refsource": "MISC",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://support.eset.com/en/ca8223-local-privilege-escalation-vulnerability-fixed-in-eset-products-for-windows"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.2,
            "confidentialityImpact": "COMPLETE",
            "integrityImpact": "COMPLETE",
            "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 10.0,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "HIGH",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2022-02-11T19:35Z",
      "publishedDate": "2022-02-09T06:15Z"
    }
  }
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2021-37852 (GCVE-0-2021-37852)

CERTFR-2022-AVI-095

Solution

Contournement provisoire

FKIE_CVE-2021-37852

GHSA-GJ8G-JFXX-VXC7

GSD-2021-37852

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour