The eParakstītājs 3.0 application prior to version 1.10.0 retrieves update descriptors over TLS but uses a permissive TrustManager and HostnameVerifier that accept any TLS certificate, effectively disabling TLS authentication. It does not verify digital signatures on the update descriptor XML nor the Authenticode signature or checksum of the downloaded installer. Consequently, an attacker capable of redirecting the update URL (www.eparaksts.lv) can supply a malicious update descriptor pointing to attacker-controlled executables, leading to arbitrary code execution on the client system.

Successful exploitation allows an attacker with network-level capabilities to perform a man-in-the-middle attack on the update process, causing the victim to download and execute arbitrary code. This compromises the victim host, potentially leading to full system compromise. The CVSS 4.0 score is 7.3 (high severity), reflecting the attack vector requiring adjacent network access but no privileges and user interaction, with high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using vulnerable versions or restrict network access to prevent redirection attacks. Monitoring for updates from the vendor and applying any official patches promptly is recommended once released.