High severity · published Apr 29, 2020
CVE-2020-11446
ESET Antivirus and Antispyware Module module 1553 through 1560 allows a user with limited access rights to create hard links in some ESET directories and then force the product to…
7.8
CVSS
0.4%
EPSS
No
On KEV
Description
ESET Antivirus and Antispyware Module module 1553 through 1560 allows a user with limited access rights to create hard links in some ESET directories and then force the product to write through these links into files that would normally not be write-able by the user, thus achieving privilege escalation.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AA
Antivirus And Antispyware · Eset
1553 through 1560 · source: NVD
EA
Endpoint Antivirus · Eset
All versions, or not specified · source: NVD
ES
Endpoint Security · Eset
All versions, or not specified · source: NVD
FS
File Security · Eset
All versions, or not specified · source: NVD
IS
Internet Security · Eset
All versions, or not specified · source: NVD
MS
Mail Security · Eset
All versions, or not specified · source: NVD
NA
Nod32 Antivirus · Eset
All versions, or not specified · source: NVD
SS
Smart Security · Eset
All versions, or not specified · source: NVD