CVE-2023-3160
📋 TL;DR
This vulnerability in ESET security software allows attackers to abuse file operations during module updates to delete or move files without proper permissions. It affects ESET products on Windows systems, potentially enabling unauthorized file manipulation.
💻 Affected Systems
- ESET Endpoint Antivirus
- ESET Endpoint Security
- ESET Server Security
- ESET File Security
- ESET Mail Security
📦 What is this software?
Nod32 by Eset
⚠️ Risk & Real-World Impact
Worst Case
Attacker could delete critical system files, move sensitive data, or disrupt system operations by manipulating files without authorization.
Likely Case
Local attacker with limited privileges could delete or move user files, potentially causing data loss or system instability.
If Mitigated
With proper access controls and monitoring, impact is limited to non-critical file operations by authenticated users.
🎯 Exploit Status
Requires local access and knowledge of the vulnerability. No public exploit code available at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.1.2046.0 and later
Vendor Advisory: https://support.eset.com/en/ca8466
Restart Required: Yes
Instructions:
1. Open ESET product interface. 2. Navigate to Update section. 3. Click 'Check for updates'. 4. Install available updates. 5. Restart computer when prompted.
🔧 Temporary Workarounds
Disable automatic updates
windowsTemporarily disable automatic module updates to prevent exploitation during update process
Open ESET interface > Setup > Advanced setup > Update > Profile > Uncheck 'Enable automatic update'
🧯 If You Can't Patch
- Implement strict access controls to limit local user privileges
- Enable file integrity monitoring to detect unauthorized file operations
🔍 How to Verify
Check if Vulnerable:
Check ESET product version in the application interface under Help > AboutCheck Version:
Open ESET interface and navigate to Help > AboutVerify Fix Applied:
Verify version is 10.1.2046.0 or higher in Help > About section📡 Detection & Monitoring
Log Indicators:
- Unexpected file deletion/movement events during ESET updates
- Access denied errors for file operations by ESET processes
Network Indicators:
- Unusual update patterns from ESET servers
SIEM Query:
source="eset_logs" AND (event_type="file_operation" AND result="denied") OR (process="ekrn.exe" AND operation="move_file" OR operation="delete_file")