vulnwire
5.1med

CVE-2025-2425

TOCTOU race condition vulnerability in ESET products on Windows

Published 15 mo ago · modified 4 mo ago · JSON

CVSS
5.1
v4.0 · CNA
CISA KEV
No
not known exploited
EPSS
0.1%
percentile 2%
Public exploits
0
none known

Time-of-check to time-of-use race condition vulnerability potentially allowed an attacker to use the installed ESET security software to clear the content of an arbitrary file on the file system.

CISA SSVC assessment

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
15 mo ago

Exploit prediction (EPSS)

0.12% probability of exploitation in the next 30 days, higher than 2% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA4.05.1CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CNA4.05.1CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • ESET, spol. s.r.o ESET NOD32 Antivirus
  • ESET, spol. s.r.o ESET Internet Security
  • ESET, spol. s.r.o ESET Smart Security Premium
  • ESET, spol. s.r.o ESET Security Ultimate
  • ESET, spol. s.r.o ESET Endpoint Antivirus for Windows
  • ESET, spol. s.r.o ESET Endpoint Security for Windows
  • ESET, spol. s.r.o ESET Small Business Security
  • ESET, spol. s.r.o ESET Safe Server
  • ESET, spol. s.r.o ESET Server Security for Windows Server
  • ESET, spol. s.r.o ESET Mail Security for Microsoft Exchange Server
  • ESET, spol. s.r.o ESET Security for Microsoft SharePoint Server

Classification

Weakness
  • CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

References

  • support.eset.com /en/ca8840-eset-customer-advisory-toctou-race-condition-vulnerability-in-eset-products-on-

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.