Skip to main content

Eset CVE-2020-10180

CRITICAL
Interpretation Conflict (CWE-436)
2020-03-05 cve@mitre.org
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Mar 05, 2020 - 19:15 nvd
CRITICAL 9.8

DescriptionNVD

The ESET AV parsing engine allows virus-detection bypass via a crafted BZ2 Checksum field in an archive. This affects versions before 1294 of Smart Security Premium, Internet Security, NOD32 Antivirus, Cyber Security Pro (macOS), Cyber Security (macOS), Mobile Security for Android, Smart TV Security, and NOD32 Antivirus 4 for Linux Desktop.

AnalysisAI

The ESET AV parsing engine allows virus-detection bypass via a crafted BZ2 Checksum field in an archive. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-436. The ESET AV parsing engine allows virus-detection bypass via a crafted BZ2 Checksum field in an archive. This affects versions before 1294 of Smart Security Premium, Internet Security, NOD32 Antivirus, Cyber Security Pro (macOS), Cyber Security (macOS), Mobile Security for Android, Smart TV Security, and NOD32 Antivirus 4 for Linux Desktop. Affected products include: Eset Cyber Security, Eset Mobile Security, Eset Nod32 Antivirus, Eset Smart Security, Eset Smart Tv Security. Version information: before 1294.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Eset

View all
CVE-2015-8841 CRITICAL POC
9.8 Apr 12

Heap-based buffer overflow in the Archive support module in ESET NOD32 before update 11861 allows remote attackers to ex

CVE-2024-0353 HIGH POC
7.8 Feb 15

Local privilege escalation vulnerability potentially allowed an attacker to misuse ESET’s file operations to delete file

CVE-2014-4973 MEDIUM POC
6.9 Sep 23

The ESET Personal Firewall NDIS filter (EpFwNdis.sys) driver in the Firewall Module Build 1183 (20140214) and earlier in

CVE-2016-9892 MEDIUM POC
5.9 Mar 02

The esets_daemon service in ESET Endpoint Antivirus for macOS before 6.4.168.0 and Endpoint Security for macOS before 6.

CVE-2024-7400 HIGH
8.5 Sep 27

The vulnerability potentially allowed an attacker to misuse ESET’s file operations during the removal of a detected file

CVE-2023-3160 HIGH
7.8 Aug 14

The vulnerability potentially allows an attacker to misuse ESET’s file operations during the module update to delete or

CVE-2023-2847 HIGH
7.8 Jun 15

During internal security analysis, a local privilege escalation vulnerability has been identified. Rated high severity (

CVE-2020-11446 HIGH
7.8 Apr 29

ESET Antivirus and Antispyware Module module 1553 through 1560 allows a user with limited access rights to create hard l

CVE-2019-16519 HIGH
7.8 Oct 14

ESET Cyber Security 6.7.900.0 for macOS allows a local attacker to execute unauthorized commands as root by abusing an u

CVE-2018-0649 HIGH
7.8 Sep 07

Untrusted search path vulnerability in the installers of multiple Canon IT Solutions Inc. Rated high severity (CVSS 7.8)

CVE-2022-0615 HIGH
7.5 Feb 25

Use-after-free in eset_rtp kernel module used in ESET products for Linux allows potential attacker to trigger denial-of-

CVE-2020-10193 HIGH
7.5 Mar 06

ESET Archive Support Module before 1294 allows virus-detection bypass via crafted RAR Compression Information in an arch

Share

CVE-2020-10180 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy