ESET spol s.r.o. vulnerabilities and threats

An improper access control vulnerability in ESET Endpoint Encryption and ESET Full Disk Encryption allow attacker with standard user permissions access a device interface belonging to a privileged kernel driver and send specially crafted requests.

Allocation of resources without limits or throttling vulnerability in ESET PROTECT On-Prem increased resource consumption (CPU and RAM), leading to conditions for a Denial-of-Service attack.

Improper Privilege Management vulnerability in ESET AV Remover (standalone) allows Privilege Escalation via especially crafted RPC.

Local privilege escalation potentially allowed an attacker to execute arbitrary code as a privileged user.

Local privilege escalation potentially allowed an attacker to write an arbitrary file with fully controlled content as a privileged user.

Use-after-free vulnerability in ESET Linux products potentially allowed an attacker to trigger kernel panic on the system

A local privilege escalation vulnerability in ESET Inspect Connector.  The vulnerability was caused by improper authentication in an IPC channel.

User enumeration in ESET Protect (on-prem) via Response Timing.

Local privilege escalation vulnerability via insecure temporary batch file execution in ESET Management Agent

Planting a custom configuration file in ESET Inspect Connector allow load a malicious DLL.

Time-of-check to time-of-use race condition vulnerability potentially allowed an attacker to use the installed ESET security software to clear the content of an arbitrary file on the file system.

Installation file of ESET security products on Windows allow an attacker to misuse to delete an arbitrary file without having the permissions to do so.

Local privilege escalation vulnerability potentially allowed an attacker to misuse ESET’s file operations to delete files without having proper permission.