CVE-2024-0353

Local privilege escalation in Windows products

Published Feb 15, 2024 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

Local privilege escalation vulnerability potentially allowed an attacker to misuse ESET’s file operations to delete files without having proper permission.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

ESET, spol. s r.o.

ESET NOD32 Antivirus

unaffected

Version	Status	Constraints
`0`	affected	≤ 16.2.15.0

ESET, spol. s r.o.

ESET Internet Security

unaffected

Version	Status	Constraints
`0`	affected	≤ 16.2.15.0

ESET, spol. s r.o.

ESET Smart Security Premium

unaffected

Version	Status	Constraints
`0`	affected	≤ 16.2.15.0

ESET, spol. s r.o.

ESET Security Ultimate

unaffected

Version	Status	Constraints
`0`	affected	≤ 16.2.15.0

ESET, spol. s r.o.

ESET Endpoint Antivirus for Windows

unaffected

Version	Status	Constraints
`0`	affected	≤ 10.1.2058.0
`0`	affected	≤ 10.0.2049.0
`0`	affected	≤ 9.1.2066.0
`0`	affected	≤ 8.1.2052.0

ESET, spol. s r.o.

ESET Endpoint Security for Windows

unaffected

Version	Status	Constraints
`0`	affected	≤ 10.1.2058.0
`0`	affected	≤ 10.0.2049.0
`0`	affected	≤ 9.1.2066.0
`0`	affected	≤ 8.1.2052.0

ESET, spol. s r.o.

ESET Server Security for Windows Server

unaffected

Version	Status	Constraints
`0`	affected	≤ 10.0.12014.0
`0`	affected	≤ 9.0.12018.0
`0`	affected	≤ 8.0.12015.0
`0`	affected	≤ 7.3.12011.0

ESET, spol. s r.o.

ESET Mail Security for Microsoft Exchange Server

unaffected

Version	Status	Constraints
`0`	affected	≤ 10.1.10010.0
`0`	affected	≤ 10.0.10017.0
`0`	affected	≤ 9.0.10011.0
`0`	affected	≤ 8.0.10022.0
`0`	affected	≤ 7.3.10014.0

ESET, spol. s r.o.

ESET Mail Security for IBM Domino

unaffected

Version	Status	Constraints
`0`	affected	≤ 10.0.14006.0
`0`	affected	≤ 9.0.14007.0
`0`	affected	≤ 8.0.14010.0
`0`	affected	≤ 7.3.14004.0

ESET, spol. s r.o.

ESET Security for Microsoft SharePoint Server

unaffected

Version	Status	Constraints
`0`	affected	≤ 10.0.15004.0
`0`	affected	≤ 9.0.15005.0
`0`	affected	≤ 8.0.15011.0
`0`	affected	≤ 7.3.15004.0

ESET, spol. s r.o.

ESET File Security for Microsoft Azure

unaffected

Version	Status	Constraints
`0`	affected	≤ all versions

Configuration 1 [-]

OR	cpe:2.3:a:eset:endpoint_antivirus::::::windows::*
	cpe:2.3:a:eset:endpoint_antivirus::::::windows::*
	cpe:2.3:a:eset:endpoint_antivirus::::::windows::*
	cpe:2.3:a:eset:endpoint_antivirus::::::windows::*
	cpe:2.3:a:eset:endpoint_antivirus::::::windows::*
	cpe:2.3:a:eset:endpoint_security::::::windows::*
	cpe:2.3:a:eset:endpoint_security::::::windows::*
	cpe:2.3:a:eset:endpoint_security::::::windows::*
	cpe:2.3:a:eset:endpoint_security::::::windows::*
	cpe:2.3:a:eset:endpoint_security::::::windows::*
	cpe:2.3:a:eset:file_security::::::azure::*
	cpe:2.3:a:eset:internet_security::::::::
	cpe:2.3:a:eset:mail_security::::::exchange_server::*
	cpe:2.3:a:eset:mail_security::::::domino::*
	cpe:2.3:a:eset:mail_security::::::exchange_server::*
	cpe:2.3:a:eset:mail_security::::::domino::*
	cpe:2.3:a:eset:mail_security::::::exchange_server::*
	cpe:2.3:a:eset:mail_security::::::domino::*
	cpe:2.3:a:eset:mail_security::::::exchange_server::*
	cpe:2.3:a:eset:mail_security::::::domino::*
	cpe:2.3:a:eset:mail_security::::::exchange_server::*
	cpe:2.3:a:eset:nod32_antivirus::::::::
	cpe:2.3:a:eset:security::::::sharepoint_server::*
	cpe:2.3:a:eset:security:::::ultimate:::*
	cpe:2.3:a:eset:security::::::sharepoint_server::*
	cpe:2.3:a:eset:security::::::sharepoint_server::*
	cpe:2.3:a:eset:security::::::sharepoint_server::*
	cpe:2.3:a:eset:server_security::::::windows_server::*
	cpe:2.3:a:eset:server_security::::::windows_server::*
	cpe:2.3:a:eset:server_security::::::windows_server::*
	cpe:2.3:a:eset:server_security::::::windows_server::*
	cpe:2.3:a:eset:smart_security:::::premium:::*

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2024-16149	Local privilege escalation vulnerability potentially allowed an attacker to misuse ESET’s file operations to delete files without having proper permission.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.551% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://packetstormsecurity.com/files/179495/ESET-NOD32-Antivirus-17.2.7.0-Unquoted-Service-Path.html
https://packetstormsecurity.com/files/182464/ESET-NOD32-Antivirus-18.0.12.0-Unquoted-Service-Path.html
https://support.eset.com/en/ca8612-eset-customer-advisory-link-following-local-privilege-escalation-vulnerability-in-eset-products-for-windows-fixed
https://www.exploit-db.com/exploits/51351
https://www.exploit-db.com/exploits/51964

History

Dec 10, 2025 8:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://www.exploit-db.com/exploits/51351 https://www.exploit-db.com/exploits/51964

Dec 10, 2025 8:15 PM First appearance in the feed. Affected versions updated. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Eset security Ultimate Eset smart Security Premium
CPEs		cpe:2.3:a:eset:endpoint_antivirus:-:::::windows:: cpe:2.3:a:eset:endpoint_security:-:::::windows:: cpe:2.3:a:eset:file_security:-:::::azure:: cpe:2.3:a:eset:mail_security:-:::::domino:: cpe:2.3:a:eset:mail_security:-:::::exchange_server:: cpe:2.3:a:eset:security:-:::::sharepoint_server:: cpe:2.3:a:eset:security_ultimate:::::::: cpe:2.3:a:eset:server_security:-:::::windows_server:: cpe:2.3:a:eset:smart_security_premium::::::::
Vendors & Products		Eset security Ultimate Eset smart Security Premium
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jan 23, 2025 5:45 PM First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Eset Eset endpoint Antivirus Eset endpoint Security Eset file Security Eset internet Security Eset mail Security Eset nod32 Antivirus Eset security Eset server Security Eset smart Security
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:a:eset:endpoint_antivirus::::::windows::* cpe:2.3:a:eset:endpoint_security::::::windows::* cpe:2.3:a:eset:file_security::::::azure::* cpe:2.3:a:eset:internet_security:::::::: cpe:2.3:a:eset:mail_security::::::domino::* cpe:2.3:a:eset:mail_security::::::exchange_server::* cpe:2.3:a:eset:nod32_antivirus:::::::: cpe:2.3:a:eset:security::::::sharepoint_server::* cpe:2.3:a:eset:security:::::ultimate:::* cpe:2.3:a:eset:server_security::::::windows_server::* cpe:2.3:a:eset:smart_security:::::premium:::*
Vendors & Products		Eset Eset endpoint Antivirus Eset endpoint Security Eset file Security Eset internet Security Eset mail Security Eset nod32 Antivirus Eset security Eset server Security Eset smart Security

Nov 25, 2024 7:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://packetstormsecurity.com/files/179495/ESET-NOD32-Antivirus-17.2.7.0-Unquoted-Service-Path.html https://packetstormsecurity.com/files/182464/ESET-NOD32-Antivirus-18.0.12.0-Unquoted-Service-Path.html

Subscriptions

Eset Endpoint Antivirus Endpoint Security File Security Internet Security Mail Security Nod32 Antivirus Security Security Ultimate Server Security Smart Security Smart Security Premium

Weaknesses