High severity · published Apr 1, 2020
CVE-2020-10866
An issue was discovered in Avast Antivirus before 20
7.5
CVSS
1.2%
EPSS
No
On KEV
Description
An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) allows attackers to enumerate the network interfaces and access points from a Low Integrity process via RPC.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AN
Antivirus · Avast
before 20.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-10866
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-10866
Release Notes
https://forum.avast.com/index.php?topic=232420.0
Release Notes
https://forum.avast.com/index.php?topic=232423.0
Exploit
https://github.com/umarfarook882/Avast_Multiple_Vulnerability_Disclosure/blob/master/README.md
More from Antivirus
9.8
CVE-2025-3500
Integer Overflow in Avast Antiviurs 25.1.981.6 on Windows may result in privilege escalation
9.8
CVE-2020-10867
An issue was discovered in Avast Antivirus before 20
9.8
CVE-2017-8307
In Avast Antivirus before v17, using the LPC interface API exposed by the AvastSVC.exe Windows service, it is possible to launch predefined binaries, or replace or delete…
8.8
CVE-2021-45337
Privilege escalation vulnerability in the Self-Defense driver of Avast Antivirus prior to 20.8 allows a local user with SYSTEM privileges to gain elevated privileges by…
8.8
CVE-2021-45336
Privilege escalation vulnerability in the Sandbox component of Avast Antivirus prior to 20.4 allows a local sandboxed code to gain elevated privileges by using system IPC…