vulnwire
7.3high

CVE-2024-2003

Local Privilege Escalation in Quarantine of ESET products for Windows

Published 2 y ago · modified 4 mo ago · JSON

CVSS
7.3
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.3%
percentile 24%
Public exploits
0
none known

Local privilege escalation vulnerability allowed an attacker to misuse ESET's file operations during a restore operation from quarantine.

CISA SSVC assessment

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction (EPSS)

0.31% probability of exploitation in the next 30 days, higher than 24% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA3.17.3CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CNA3.17.3CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Affected products

  • ESET, spol. s r.o. ESET NOD32 Antivirus
  • ESET, spol. s r.o. ESET Internet Security
  • ESET, spol. s r.o. ESET Smart Security Premium
  • ESET, spol. s r.o. ESET Security Ultimate
  • ESET, spol. s r.o. ESET Small Business Security
  • ESET, spol. s r.o. ESET Safe Server
  • ESET, spol. s r.o. ESET Endpoint Antivirus for Windows
  • ESET, spol. s r.o. ESET Endpoint Security for Windows
  • ESET, spol. s r.o. ESET Server Security for Windows Server
  • ESET, spol. s r.o. ESET Mail Security for Microsoft Exchange Server
  • ESET, spol. s r.o. ESET Mail Security for IBM Domino
  • ESET, spol. s r.o. ESET Security for Microsoft SharePoint Server
  • ESET, spol. s r.o. ESET File Security for Microsoft Azure
  • eset internet_security

Classification

Weakness
  • CWE-269 Improper Privilege Management

References

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.