Lucene search

K
zdiNicholas Zubrisky and Michael DePlante (@izobashi) of Trend Micro Zero Day InitiativeZDI-24-182
HistoryFeb 15, 2024 - 12:00 a.m.

ESET Smart Security Premium ekrn Link Following Local Privilege Escalation Vulnerability

2024-02-1500:00:00
Nicholas Zubrisky and Michael DePlante (@izobashi) of Trend Micro Zero Day Initiative
www.zerodayinitiative.com
14
eset smart security premium
local attackers
privilege escalation
eset service
symbolic link
arbitrary code
system context

AI Score

7.5

Confidence

High

EPSS

0.001

Percentile

28.8%

This vulnerability allows local attackers to escalate privileges on affected installations of ESET Smart Security Premium. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the ESET Service. By creating a symbolic link, an attacker can abuse the service to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM.

AI Score

7.5

Confidence

High

EPSS

0.001

Percentile

28.8%