CVE-2025-1364
📋 TL;DR
A critical stack-based buffer overflow vulnerability in MicroWord eScan Antivirus 7.0.32 on Linux allows local attackers to execute arbitrary code via the USB Protection Service's passPrompt function. This affects Linux systems running the vulnerable antivirus software. The exploit is publicly available and the vendor has not responded to disclosure.
💻 Affected Systems
- MicroWord eScan Antivirus
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation leading to full system compromise, data theft, or ransomware deployment.
Likely Case
Local user gains elevated privileges to install malware, access sensitive files, or disrupt system operations.
If Mitigated
Limited impact if antivirus is uninstalled or USB Protection Service is disabled.
🎯 Exploit Status
Exploit code is publicly available in GitHub repository. Requires local access to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider uninstalling eScan Antivirus 7.0.32 or disabling USB Protection Service.
🔧 Temporary Workarounds
Disable USB Protection Service
linuxStop and disable the vulnerable USB Protection Service component
sudo systemctl stop escan-usb-protection
sudo systemctl disable escan-usb-protection
Uninstall eScan Antivirus
linuxRemove the vulnerable software entirely
sudo apt remove escan-antivirus
sudo yum remove escan-antivirus
🧯 If You Can't Patch
- Implement strict access controls to limit local user privileges
- Monitor for unusual process activity from eScan components
🔍 How to Verify
Check if Vulnerable:
Check if eScan Antivirus version 7.0.32 is installed and USB Protection Service is runningCheck Version:
escan --version | grep '7.0.32'Verify Fix Applied:
Verify eScan Antivirus is uninstalled or USB Protection Service is stopped and disabled📡 Detection & Monitoring
Log Indicators:
- Unusual process crashes in eScan components
- Privilege escalation attempts from eScan processes
Network Indicators:
- None - local exploit only
SIEM Query:
Process creation where parent process contains 'escan' and child process has elevated privileges