CVE-2025-1369

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-1369
A vulnerability classified as critical was found in MicroWord eScan Antivirus 7.0.32 on Linux. Affected by this vulnerability is an unknown functionality of the component USB Password Handler. The manipulation leads to os command injection. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

4.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.0 / Impact : 3.4

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

3.5 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:L/AC:H/Au:S/C:P/I:P/A:P

Exploitability : 1.5 / Impact : 6.4

Access Vector LOCAL

Access Complexity HIGH

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://github.com/dmknght/FIS_RnD/blob/main/escan_av_usb_protection_multiple_vulns.md Exploit Third Party Advisory
https://vuldb.com/?ctiid.295975 Permissions Required Third Party Advisory VDB Entry
https://vuldb.com/?id.295975 Third Party Advisory VDB Entry
https://vuldb.com/?submit.496482 Third Party Advisory VDB Entry
https://github.com/dmknght/FIS_RnD/blob/main/escan_av_usb_protection_multiple_vulns.md Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:escanav:escan_anti-virus:7.0.32:*:*:*:*:linux:*:*
History

27 Jun 2025, 17:45

Type Values Removed Values Added
References () https://github.com/dmknght/FIS_RnD/blob/main/escan_av_usb_protection_multiple_vulns.md - () https://github.com/dmknght/FIS_RnD/blob/main/escan_av_usb_protection_multiple_vulns.md - Exploit, Third Party Advisory
References () https://vuldb.com/?ctiid.295975 - () https://vuldb.com/?ctiid.295975 - Permissions Required, Third Party Advisory, VDB Entry
References () https://vuldb.com/?id.295975 - () https://vuldb.com/?id.295975 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.496482 - () https://vuldb.com/?submit.496482 - Third Party Advisory, VDB Entry
CPE cpe:2.3:a:escanav:escan_anti-virus:7.0.32:*:*:*:*:linux:*:*
First Time Escanav
Escanav escan Anti-virus

18 Feb 2025, 20:15

Type Values Removed Values Added
References () https://github.com/dmknght/FIS_RnD/blob/main/escan_av_usb_protection_multiple_vulns.md - () https://github.com/dmknght/FIS_RnD/blob/main/escan_av_usb_protection_multiple_vulns.md -
Summary
  • (es) En MicroWord eScan Antivirus 7.0.32 para Linux se ha detectado una vulnerabilidad clasificada como crítica. Esta vulnerabilidad afecta a una funcionalidad desconocida del componente USB Password Handler. La manipulación conduce a la inyección de comandos en el sistema operativo. El ataque debe abordarse de forma local. La complejidad de un ataque es bastante alta. La explotación parece ser difícil. La explotación se ha hecho pública y puede utilizarse. Se contactó al proveedor con antelación sobre esta revelación, pero no respondió de ninguna manera.

17 Feb 2025, 02:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-17 02:15

Updated : 2025-06-27 17:45

NVD link : CVE-2025-1369

Mitre link : CVE-2025-1369

CVE.ORG link : CVE-2025-1369

JSON object : View

Products Affected

escanav

  • escan_anti-virus
CWE
CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')