CVE-2020-10180 Security feature bypass in n/a

What is CVE-2020-10180?

CVE-2020-10180 is a critical vulnerability in n/a, published on 5 Mar 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The ESET AV parsing engine allows virus-detection bypass via a crafted BZ2 Checksum field in an archive. This affects versions before 1294 of Smart Security Premium, Internet Security, NOD32 Antivirus, Cyber Security Pro (macOS), Cyber Security (macOS), Mobile Security for Android, Smart TV Security, and NOD32 Antivirus 4 for Linux Desktop.

Weakness: CWE-436

Which versions are affected by CVE-2020-10180?

It affects 5 products.

Products include Eset Cyber Security, Eset Mobile Security, Eset Nod32 Antivirus, Eset Smart Security, Eset Smart Tv Security.

How do I fix CVE-2020-10180?

No fix has been published for CVE-2020-10180 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-10180 being exploited?

There is no known exploitation of CVE-2020-10180 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2023-2847 Local privilege escalation in ESET products for Linux and MacOS High 7.8
• CVE-2019-16519 Privilege escalation in n/a High 7.8
• CVE-2020-10193 Security feature bypass in n/a High 7.5
• CVE-2019-17549 Denial of service in n/a Medium 6.5
• CVE-2021-37850 Denial of service in ESET for Mac products Medium 5.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xpvv-w5mx-7x26.