ESET

CVE-2025-13818 is a local privilege escalation vulnerability in ESET Management Agent for Windows caused by a Time-of-Check Time-of-Use (TOCTOU) race condition in temporary batch file handling. A local attacker with high privileges can replace a validated batch file before execution, leading to arbitrary command execution with elevated privileges. ESET has released a patch to address the issue.

A local privilege escalation vulnerability (CVE-2025-13176) was disclosed in ESET Inspect Connector for Windows. The flaw allows a low-privileged user to load a malicious DLL into the SYSTEM-level EDR agent process by exploiting a hardcoded OpenSSL configuration path. This can lead to full system compromise and potential bypass of EDR protections.

The ToddyCat APT group exploited CVE-2024-11859, a DLL sideloading vulnerability in ESET's command-line scanner (ecls.exe), to execute malicious payloads under the guise of a trusted security process. The attack used a custom malware toolkit called TCESB, which leverages BYOVD and kernel tampering to disable security monitoring. ESET patched the vulnerability on January 21, 2025.

CVE-2024-7400 is a high-severity vulnerability in ESET's Windows security products that allows a local low-privileged attacker to delete arbitrary files without proper permissions during the removal of a detected file. This could lead to data loss or system instability. No public exploit or in-the-wild exploitation has been observed.

A local privilege escalation vulnerability (CVE-2024-0353) in ESET Smart Security Premium allows a standard user to delete arbitrary files as SYSTEM by exploiting a time-of-check-to-time-of-use (TOCTOU) race condition in the real-time protection feature. The attack leverages NTFS alternate data streams to keep a directory empty during file scanning, then creates a junction to redirect a delete operation to a protected directory like C:\Config.msi. This technique, introduced by researcher Abdelhamid Naceri, bypasses assumptions about directory emptiness and can potentially affect other security products.

BOAZ is a modular evasion framework that combines signature, heuristic, and behavioral bypass techniques to generate undetectable payloads. It was tested against 14 desktop AVs and 7 EDRs, including Sophos, Windows Defender, and ESET. The tool serves as both an evasion testing utility and a packer/obfuscator for researchers.

CVE-2023-7043 is a low-severity unquoted service path vulnerability in multiple ESET products for Windows. An attacker with local access and low privileges can place a malicious executable in a specific path, which then runs with NetworkService privileges on boot. This could allow limited privilege escalation and integrity impact.

Trend Micro observed threat actors attempting to use EDRSilencer, a red team tool that leverages Windows Filtering Platform to block outbound network traffic from EDR processes. The tool dynamically identifies running EDR executables and creates persistent WFP filters, preventing telemetry and alert transmission to management consoles. This technique can allow malware to evade detection by silencing endpoint security solutions.

CVE-2023-5594 is an improper certificate validation vulnerability in ESET security products' secure traffic scanning feature. The flaw allows acceptance of intermediate certificates signed with weak MD5 or SHA1 algorithms, enabling man-in-the-middle attacks. This undermines TLS/SSL inspection, potentially exposing encrypted traffic to interception.

During a penetration test, researchers bypassed ESET NOD32 antivirus by modifying the Meterpreter DLL source and recompiling, and by embedding encoded shellcode in a custom executable with a filename check to evade signature detection. The technique demonstrates a practical AV evasion method using open-source tool customization.

A video and Reddit post surfaced on May 28, 2023, showing an executable that allegedly disables tamper protection and terminates the on-premise agents of numerous endpoint security products. The tool claims to work against vendors including CrowdStrike, SentinelOne, Carbon Black, and Windows Defender. ThreatLocker notes that its application allowlisting would block such an unknown executable from running.