CVE-2021-37852
LPE in ESET products for Windows
Vexday Risk Score
21Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 7.8EPSS 0.6%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
09 Feb 2022Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
ESET products for Windows allows untrusted process to impersonate the client of a pipe, which can be leveraged by attacker to escalate privileges in the context of NT AUTHORITY\SYSTEM.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
ESET · ESET Endpoint Antivirus for WindowsESET · ESET Endpoint Security for WindowsESET · ESET File Security for Microsoft Windows ServerESET · ESET Internet SecurityESET · ESET Mail Security for IBM DominoESET · ESET Mail Security for Microsoft Exchange ServerESET · ESET NOD32 AntivirusESET · ESET Security for Microsoft SharePoint ServerESET · ESET Server Security for Microsoft AzureESET · ESET Server Security for Microsoft Windows ServerESET · ESET Smart SecurityWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →