High severity · published Sep 7, 2018
CVE-2018-0649
Untrusted search path vulnerability in the installers of multiple Canon IT Solutions Inc
7.8
CVSS
1.1%
EPSS
No
On KEV
Description
Untrusted search path vulnerability in the installers of multiple Canon IT Solutions Inc. software programs (ESET Smart Security Premium, ESET Internet Security, ESET Smart Security, ESET NOD32 Antivirus, DESlock+ Pro, and CompuSec (all programs except packaged ones)) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Compusec · Eset
All versions, or not specified · source: NVD
DP
Deslock+ Pro · Eset
All versions, or not specified · source: NVD
IS
Internet Security · Eset
All versions, or not specified · source: NVD
NA
Nod32 Antivirus · Eset
All versions, or not specified · source: NVD
SS
Smart Security · Eset
All versions, or not specified · source: NVD
SS
Smart Security Premium · Eset
All versions, or not specified · source: NVD