CVE-2020-11446

Published: Apr 29, 2020Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

ESET Antivirus and Antispyware Module module 1553 through 1560 allows a user with limited access rights to create hard links in some ESET directories and then force the product to write through these links into files that would normally not be write-able by the user, thus achieving privilege escalation.

Affected (14)

Products: Eset: Antivirus And Antispyware, Endpoint Antivirus, Endpoint Security, File Security, Internet Security, Mail Security, Nod32 Antivirus, Smart Security

Eset

8 products

Antivirus And Antispyware

Configuration A

14 vulnerable

Vulnerable Software	Affected Versions
Eset Antivirus And Antispyware	From 1553 to 1560
Eset Endpoint Antivirus	All versions
Eset Endpoint Security	All versions
Eset File Security	All versions
Eset Internet Security	All versions
Eset Mail Security	All versions
Eset Mail Security	All versions
Eset Mail Security	All versions
Eset Mail Security	All versions
Eset Nod32 Antivirus	All versions
Eset Nod32 Antivirus	All versions
Eset Smart Security	All versions
Eset Smart Security	All versions
Eset Smart Security	All versions

Related CWEs

CWE-59

Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

References (2)

https://support.eset.com/en/ca7489-local-privilege-escalation-vulnerability-fixed-in-eset-products-for-windows

Source: cve@mitre.org

Vendor Advisory

https://support.eset.com/en/ca7489-local-privilege-escalation-vulnerability-fixed-in-eset-products-for-windows

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.