ESET NOD32 Antivirus uncontrolled search path

Summaryinfo

A vulnerability identified as problematic has been detected in ESET NOD32 Antivirus, Internet Security, Smart Security Premium, Security Ultimate, Endpoint Antivirus for Windows, Endpoint Security for Windows, Small Business Security, Safe Server, Server Security for Windows Server, Mail Security for Microsoft Exchange Server and Security for Microsoft SharePoint Server. This affects an unknown function. The manipulation leads to uncontrolled search path. This vulnerability is documented as CVE-2024-11859. The attack needs to be performed locally. There is not any exploit available.

Detailsinfo

A vulnerability was found in ESET NOD32 Antivirus, Internet Security, Smart Security Premium, Security Ultimate, Endpoint Antivirus for Windows, Endpoint Security for Windows, Small Business Security, Safe Server, Server Security for Windows Server, Mail Security for Microsoft Exchange Server and Security for Microsoft SharePoint Server. It has been rated as critical. This issue affects some unknown functionality. The manipulation with an unknown input leads to a uncontrolled search path vulnerability. Using CWE to declare the problem leads to CWE-427. The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

DLL Search Order Hijacking vulnerability potentially allowed an attacker with administrator privileges to load a malicious dynamic-link library and execute its code.

The advisory is shared at support.eset.com. The identification of this vulnerability is CVE-2024-11859 since 11/27/2024. The exploitation is known to be difficult. An attack has to be approached locally. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 04/16/2025). MITRE ATT&CK project uses the attack technique T1574 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Groupware Software

Vendor

• ESET

Name

• Endpoint Antivirus for Windows
• Endpoint Security for Windows
• Internet Security
• Mail Security for Microsoft Exchange Server
• NOD32 Antivirus
• Safe Server
• Security for Microsoft SharePoint Server
• Security Ultimate
• Server Security for Windows Server
• Small Business Security
• Smart Security Premium

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion