title: Local privilege escalation in Windows products
description: Local privilege escalation vulnerability potentially allowed an attacker to misuse ESET’s file operations to delete files without having proper permission.
problem types: CWE-269 Improper Privilege Management
affected:
{
defaultStatus: unaffected
product: ESET NOD32 Antivirus
vendor: ESET, spol. s r.o.
versions:
lessThanOrEqual: 16.2.15.0, status: affected, version: 0, versionType: custom
}
{
defaultStatus: unaffected
product: ESET Internet Security
vendor: ESET, spol. s r.o.
versions:
lessThanOrEqual: 16.2.15.0, status: affected, version: 0, versionType: custom
}
{
defaultStatus: unaffected
product: ESET Smart Security Premium
vendor: ESET, spol. s r.o.
versions:
lessThanOrEqual: 16.2.15.0, status: affected, version: 0, versionType: custom
}
{
defaultStatus: unaffected
product: ESET Security Ultimate
vendor: ESET, spol. s r.o.
versions:
lessThanOrEqual: 16.2.15.0, status: affected, version: 0, versionType: custom
}
{
defaultStatus: unaffected
product: ESET Endpoint Antivirus for Windows
vendor: ESET, spol. s r.o.
versions:
lessThanOrEqual: 10.1.2058.0, status: affected, version: 0, versionType: custom
lessThanOrEqual: 10.0.2049.0, status: affected, version: 0, versionType: custom
lessThanOrEqual: 9.1.2066.0, status: affected, version: 0, versionType: custom
lessThanOrEqual: 8.1.2052.0, status: affected, version: 0, versionType: custom
}
{
defaultStatus: unaffected
product: ESET Endpoint Security for Windows
vendor: ESET, spol. s r.o.
versions:
lessThanOrEqual: 10.1.2058.0, status: affected, version: 0, versionType: custom
lessThanOrEqual: 10.0.2049.0, status: affected, version: 0, versionType: custom
lessThanOrEqual: 9.1.2066.0, status: affected, version: 0, versionType: custom
lessThanOrEqual: 8.1.2052.0, status: affected, version: 0, versionType: custom
}
{
defaultStatus: unaffected
product: ESET Server Security for Windows Server
vendor: ESET, spol. s r.o.
versions:
lessThanOrEqual: 10.0.12014.0, status: affected, version: 0, versionType: custom
lessThanOrEqual: 9.0.12018.0, status: affected, version: 0, versionType: custom
lessThanOrEqual: 8.0.12015.0, status: affected, version: 0, versionType: custom
lessThanOrEqual: 7.3.12011.0, status: affected, version: 0, versionType: custom
}
{
defaultStatus: unaffected
product: ESET Mail Security for Microsoft Exchange Server
vendor: ESET, spol. s r.o.
versions:
lessThanOrEqual: 10.1.10010.0, status: affected, version: 0, versionType: custom
lessThanOrEqual: 10.0.10017.0, status: affected, version: 0, versionType: custom
lessThanOrEqual: 9.0.10011.0, status: affected, version: 0, versionType: custom
lessThanOrEqual: 8.0.10022.0, status: affected, version: 0, versionType: custom
lessThanOrEqual: 7.3.10014.0, status: affected, version: 0, versionType: custom
}
{
defaultStatus: unaffected
product: ESET Mail Security for IBM Domino
vendor: ESET, spol. s r.o.
versions:
lessThanOrEqual: 10.0.14006.0, status: affected, version: 0, versionType: custom
lessThanOrEqual: 9.0.14007.0, status: affected, version: 0, versionType: custom
lessThanOrEqual: 8.0.14010.0, status: affected, version: 0, versionType: custom
lessThanOrEqual: 7.3.14004.0, status: affected, version: 0, versionType: custom
}
{
defaultStatus: unaffected
product: ESET Security for Microsoft SharePoint Server
vendor: ESET, spol. s r.o.
versions:
lessThanOrEqual: 10.0.15004.0, status: affected, version: 0, versionType: custom
lessThanOrEqual: 9.0.15005.0, status: affected, version: 0, versionType: custom
lessThanOrEqual: 8.0.15011.0, status: affected, version: 0, versionType: custom
lessThanOrEqual: 7.3.15004.0, status: affected, version: 0, versionType: custom
}
{
defaultStatus: unaffected
product: ESET File Security for Microsoft Azure
vendor: ESET, spol. s r.o.
versions:
lessThanOrEqual: all versions, status: affected, version: 0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL