Vulnerability · Published Aug 3, 2026 · Assigned by ENISA
CVE-2026-0392eParakstītājs 3.0 for Windows – remote code execution via unauthenticated auto-update
High 7.3
In plain English
A high-severity improper certificate validation in eParakstītājs 3.0 from Latvijas Valsts radio un televīzijas centrs (LVRTC). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 0% of all known vulnerabilities).
Official description
eParakstītājs 3.0 for Windows before version 1.10.0 retrieves and executes its automatic updates over a channel that is not authenticated or integrity-protected. On each launch the application fetches an update descriptor (XML) over TLS but accepts any TLS certificate (a permissive TrustManager and a HostnameVerifier that always returns true), does not verify any digital signature on the update descriptor, and does not verify the Authenticode signature or a checksum of the downloaded installer before running it. A man-in-the-middle attacker able to redirect www.eparaksts.lv can serve a crafted update descriptor pointing to an attacker-controlled executable, which the client downloads and executes, resulting in arbitrary code execution on the victim host.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Latvijas Valsts radio un televīzijas centrs (LVRTC) | eParakstītājs 3.0 | 0 – before 1.10.0 |
Weakness: CWE-494, CWE-295, CWE-347 · Vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- https://www.eparaksts.lv/lv/par_mums/Jaunumi/Jauna_eParakstitajs_30_versija_1100 vendor-advisory, release-notes
- https://cvd.cert.lv/inbox/view/vuln-all-1689187061 government-resource, third-party-advisory, permissions-required
- https://offseq.com/en/research/eparakstitajs-cve-2026-0392/ technical-description, third-party-advisory