An issue was discovered in Avira Free Security Suite 10.
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA.
Summary
An issue was discovered in Avira Free Security Suite 10. The permissive access rights on the SoftwareUpdater folder (files / folders and configuration) are incompatible with the privileged file manipulation performed by the product. Files can be created that can be used by an unprivileged user to obtain SYSTEM privileges. Arbitrary file creation can be achieved by abusing the SwuConfig.json file creation: an unprivileged user can replace these files by pseudo-symbolic links to arbitrary files. When an update occurs, a privileged service creates a file and sets its access rights, offering write access to the Everyone group in any directory.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:avira:free_security_suite:2019:*:*:*:*:*:*:* | 2019 | Vulnerable | Gen Digital |
| cpe:2.3:a:avira:software_updater:*:*:*:*:*:*:*:* | up to 2.0.6.13175 | Vulnerable | Gen Digital |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:a:avira:free_security_suite:2019:*:*:*:*:*:*:* Versions 2019 Vulnerable ·Gen Digital
- cpe:2.3:a:avira:software_updater:*:*:*:*:*:*:*:* Versions up to 2.0.6.13175 Vulnerable ·Gen Digital
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-11396
- 2026-10-03 Alias added: GHSA-wg87-3vq4-8632
References
More Gen Digital Free Security Suite vulnerabilities
- TI-2017-04224 Code injection vulnerability in Avira Total Security Suite 15.0 (and earlier)… CVSS 3.0MEDIUM 6.7
Sources
- CVE-2019-11396 · CVE Program
- CVE-2019-11396 · NVD
- FIRST EPSS
- GHSA-wg87-3vq4-8632 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences