The vulnerability in Latvijas Valsts radio un televīzijas centrs (LVRTC) eParakstītājs 3.0 affects versions prior to 1.10.0. The software retrieves update descriptors over TLS but uses a permissive TrustManager and HostnameVerifier that accept any TLS certificate, effectively disabling TLS authentication. It also lacks verification of digital signatures on the update descriptor and does not verify the Authenticode signature or checksum of the downloaded installer before execution. An attacker capable of redirecting the update URL (www.eparaksts.lv) can supply a malicious update descriptor pointing to a crafted executable, which the client downloads and runs, resulting in arbitrary code execution.

Successful exploitation allows a remote attacker with network position to perform man-in-the-middle attacks to deliver malicious updates. This leads to arbitrary code execution on the victim's system without requiring privileges or user interaction beyond launching the application. The vulnerability compromises the integrity and authenticity of the update mechanism, posing a high security risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using the affected versions or restrict network access to prevent redirection attacks. Monitor vendor communications for updates and apply patches promptly once released.