Lucene search
ESETCVELIST:CVE-2023-7043HistoryJan 31, 2024 - 12:51 p.m.
CVE-2023-7043 Unquoted path privilege vulnerability in ESET products for Windows
2024-01-3112:51:38
CWE-428
ESET
www.cve.org
unquoted path vulnerability
eset products
windows security
unauthorized program execution
nt authority\networkservice permissions
3.3 Low
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
6.6 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
9.0%
Unquoted service path in ESET products allows to
drop a prepared program to a specific location and run on boot with the
NT AUTHORITY\NetworkService permissions.
CNA Affected
[
{
"defaultStatus": "unaffected",
"product": "ESET Endpoint Security",
"vendor": "ESET, spol. s r.o.",
"versions": [
{
"lessThanOrEqual": "10.1.2063.x",
"status": "affected",
"version": "10.1.2046.x",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ESET Endpoint Antivirus",
"vendor": "ESET, spol. s r.o.",
"versions": [
{
"lessThanOrEqual": "10.1.2063.x",
"status": "affected",
"version": "10.1.2046.x",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ESET NOD32 Antivirus",
"vendor": "ESET, spol. s r.o.",
"versions": [
{
"lessThanOrEqual": "16.2.15.0",
"status": "affected",
"version": "16.1.14.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ESET Internet Security",
"vendor": "ESET, spol. s r.o.",
"versions": [
{
"lessThanOrEqual": "16.2.15.0",
"status": "affected",
"version": "16.1.14.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ESET Smart Security Premium",
"vendor": "ESET, spol. s r.o.",
"versions": [
{
"lessThanOrEqual": "16.2.15.0",
"status": "affected",
"version": "16.1.14.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ESET Mail Security for Microsoft Exchange Server",
"vendor": "ESET, spol. s r.o.",
"versions": [
{
"status": "affected",
"version": "10.1.10012.0"
}
]
}
]References
Related
nvd
nvd
CVE-2023-7043
2024-01-31 13:15:10
cve
cve
CVE-2023-7043
2024-01-31 13:15:10
prion
prion
Design/Logic Flaw
2024-01-31 13:15:00
openvas
openvas
Microsoft Windows Unquoted Path Vulnerability (SMB Login)
2018-03-23 00:00:00
3.3 Low
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
6.6 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
9.0%
Related for CVELIST:CVE-2023-7043