High severity · published Mar 6, 2020
CVE-2020-10193
ESET Archive Support Module before 1294 allows virus-detection bypass via crafted RAR Compression Information in an archive
7.5
CVSS
1.4%
EPSS
No
On KEV
Description
ESET Archive Support Module before 1294 allows virus-detection bypass via crafted RAR Compression Information in an archive. This affects versions before 1294 of Smart Security Premium, Internet Security, NOD32 Antivirus, Cyber Security Pro (macOS), Cyber Security (macOS), Mobile Security for Android, Smart TV Security, and NOD32 Antivirus 4 for Linux Desktop.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Cyber Security · Eset
before 1294 · source: NVD
IS
Internet Security · Eset
before 1294 · source: NVD
MS
Mobile Security · Eset
before 1294; 1294 · source: NVD
NA
Nod32 Antivirus · Eset
before 4; before 1294 · source: NVD
SS
Smart Security · Eset
before 1294 · source: NVD
ST
Smart TV Security · Eset
before 1294 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-10193
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-10193
Third Party Advisory
https://blog.zoller.lu/p/from-low-hanging-fruit-department_13.html
More from Cyber Security
9.8
CVE-2020-10180
The ESET AV parsing engine allows virus-detection bypass via a crafted BZ2 Checksum field in an archive
7.8
CVE-2023-2847
During internal security analysis, a local privilege escalation vulnerability has been identified
7.8
CVE-2019-16519
ESET Cyber Security 6.7.900.0 for macOS allows a local attacker to execute unauthorized commands as root by abusing an undocumented feature in scheduled tasks
6.7
CVE-2019-19792
A permissions issue in ESET Cyber Security before 6.8.300.0 for macOS allows a local attacker to escalate privileges by appending data to root-owned files
6.5
CVE-2019-17549
ESET Cyber Security before 6.8.1.0 is vulnerable to a denial-of-service allowing any user to stop (kill) ESET processes