CVE-2021-37852

The CVE-2021-37852 entry describes a local privilege-escalation in ESET products for Windows where an untrusted process impersonates the client of a named pipe. This impersonation (named-pipe client) allows a local attacker to escalate to NT AUTHORITY\SYSTEM. Documents from ZDI and NVD confirm th...

CVE-2022-27167

CVE-2022-27167 describes a local privilege-escalation in multiple ESET Windows products, allowing an attacker to abuse the Repair/Uninstall paths to delete files. Affected products include ESET NOD32 Antivirus, Internet Security, Smart Security Premium, Endpoint Antivirus/Security, Server/File/Ma...

CVE-2020-26941

The CVE-2020-26941 issue describes a local, authenticated, low-privilege user able to trigger arbitrary file overwrite (deletion) via a symlink during the installation phase of multiple ESET products, due to insecure installer permissions. Impact is limited to the installation window and requires...

CVE-2021-37851

CVE-2021-37851 is a local privilege escalation in ESET Windows products where an unpatched installer repair flow can be abused to execute code with higher privileges. Affected are ESET NOD32 Antivirus, Internet Security, Smart Security Premium (11.2 prior to 15.1.12.0) and ESET Endpoint Antivirus...

CVE-2024-0353

CVE-2024-0353 is a local privilege escalation in ESET products (e.g., ESET Smart Security Premium / Endpoint Antivirus) where the attacker can abuse ESET’s file operations via the ESET Service. The weakness arises from a vulnerability in privilege handling and a symbolic link abuse that allows de...

CVE-2023-5594

CVE-2023-5594 describes improper validation of the server’s certificate chain in the secure traffic scanning feature, causing intermediate certificates signed with MD5 or SHA-1 to be treated as trusted. Multiple sources (NVD, CVE List, CNNVD, PRION/PRION-like entries, and EUVD) tie this to ESET s...

CVE-2020-11446

The CVE-2020-11446 entry concerns ESET Antivirus and Antispyware Module versions 1553–1560. A user with limited rights can create hard links in certain ESET directories and force the product to write through these links to files normally not writable, enabling privilege escalation. The issue is l...