Latvijas Valsts radio un televīzijas centrs eParakstītājs up to 1.9.x Update certificate validation

Summaryinfo

A vulnerability marked as problematic has been reported in Latvijas Valsts radio un televīzijas centrs eParakstītājs up to 1.9.x. The impacted element is an unknown function of the component Update Handler. Performing a manipulation results in certificate validation. This vulnerability is reported as CVE-2026-0392. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Latvijas Valsts radio un televīzijas centrs eParakstītājs up to 1.9.x. It has been classified as problematic. This affects an unknown code of the component Update Handler. The manipulation with an unknown input leads to a certificate validation vulnerability. CWE is classifying the issue as CWE-295. The product does not validate, or incorrectly validates, a certificate. This is going to have an impact on integrity. The summary by CVE is:

eParakstītājs 3.0 for Windows before version 1.10.0 retrieves and executes its automatic updates over a channel that is not authenticated or integrity-protected. On each launch the application fetches an update descriptor (XML) over TLS but accepts any TLS certificate (a permissive TrustManager and a HostnameVerifier that always returns true), does not verify any digital signature on the update descriptor, and does not verify the Authenticode signature or a checksum of the downloaded installer before running it. A man-in-the-middle attacker able to redirect www.eparaksts.lv can serve a crafted update descriptor pointing to an attacker-controlled executable, which the client downloads and executes, resulting in arbitrary code execution on the victim host.

The advisory is shared at eparaksts.lv. This vulnerability is uniquely identified as CVE-2026-0392 since 11/27/2025. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1587.003 for this issue.

Upgrading to version 1.10.0 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Latvijas Valsts radio un televīzijas centrs

Name

• eParakstītājs

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion