Vulnerability · Published Feb 15, 2024 · Assigned by ESET
CVE-2024-0353Local privilege escalation in Windows products
High 7.8
In plain English
A high-severity privilege mismanagement in ESET Endpoint Antivirus for Windows from ESET, spol. s r.o.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 46% of all known vulnerabilities).
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.6%top 53.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Local privilege escalation vulnerability potentially allowed an attacker to misuse ESET’s file operations to delete files without having proper permission.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ESET, spol. s r.o. | ESET NOD32 Antivirus | 0 – through 16.2.15.0 |
| ESET, spol. s r.o. | ESET Internet Security | 0 – through 16.2.15.0 |
| ESET, spol. s r.o. | ESET Smart Security Premium | 0 – through 16.2.15.0 |
| ESET, spol. s r.o. | ESET Security Ultimate | 0 – through 16.2.15.0 |
| ESET, spol. s r.o. | ESET Endpoint Antivirus for Windows | 0 – through 10.1.2058.00 – through 10.0.2049.00 – through 9.1.2066.00 – through 8.1.2052.0 |
| ESET, spol. s r.o. | ESET Endpoint Security for Windows | 0 – through 10.1.2058.00 – through 10.0.2049.00 – through 9.1.2066.00 – through 8.1.2052.0 |
| ESET, spol. s r.o. | ESET Server Security for Windows Server | 0 – through 10.0.12014.00 – through 9.0.12018.00 – through 8.0.12015.00 – through 7.3.12011.0 |
| ESET, spol. s r.o. | ESET Mail Security for Microsoft Exchange Server | 0 – through 10.1.10010.00 – through 10.0.10017.00 – through 9.0.10011.00 – through 8.0.10022.00 – through 7.3.10014.0 |
| ESET, spol. s r.o. | ESET Mail Security for IBM Domino | 0 – through 10.0.14006.00 – through 9.0.14007.00 – through 8.0.14010.00 – through 7.3.14004.0 |
| ESET, spol. s r.o. | ESET Security for Microsoft SharePoint Server | 0 – through 10.0.15004.00 – through 9.0.15005.00 – through 8.0.15011.00 – through 7.3.15004.0 |
| ESET, spol. s r.o. | ESET File Security for Microsoft Azure | 0 – through all versions |
Weakness: CWE-269 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://support.eset.com/en/ca8612-eset-customer-advisory-link-following-local-privilege-escalation-vulnerability-in-eset-products-for-windows-fixed
- https://packetstormsecurity.com/files/182464/ESET-NOD32-Antivirus-18.0.12.0-Unquoted-Service-Path.html
- https://packetstormsecurity.com/files/179495/ESET-NOD32-Antivirus-17.2.7.0-Unquoted-Service-Path.html
- https://www.exploit-db.com/exploits/51351
- https://www.exploit-db.com/exploits/51964