Eset Endpoint Encryption
Monthly
Improper access control in ESET Endpoint Encryption up to 5.4.23.0 and ESET Full Disk Encryption up to 2.4.4.0 on Windows allows a local standard user to open a device interface exposed by a privileged ESET kernel driver and submit specially crafted requests, resulting in high confidentiality, integrity and availability impact on the affected endpoint. The flaw is local only and requires an already-established low-privileged account (CVSS:4.0 PR:L, independently assessed as CVSS:3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.5), so exposure is confined to managed Windows endpoints running these encryption products below the fixed builds. No public exploit code or active exploitation is identified in the available data, and the vendor has published a fixed-build advisory (ESET ca9033).
Improper access control in ESET Endpoint Encryption up to 5.4.23.0 and ESET Full Disk Encryption up to 2.4.4.0 on Windows allows a local standard user to open a device interface exposed by a privileged ESET kernel driver and submit specially crafted requests, resulting in high confidentiality, integrity and availability impact on the affected endpoint. The flaw is local only and requires an already-established low-privileged account (CVSS:4.0 PR:L, independently assessed as CVSS:3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.5), so exposure is confined to managed Windows endpoints running these encryption products below the fixed builds. No public exploit code or active exploitation is identified in the available data, and the vendor has published a fixed-build advisory (ESET ca9033).