Read the docs
TI-2023-02668 Aliases CVE-2023-2847GHSA-5p64-g2j6-m9w7

Local privilege escalation in ESET products for Linux and MacOS

Priority LOW 35CWE-269Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-269.

Summary

During internal security analysis, a local privilege escalation vulnerability has been identified. On a machine with the affected ESET product installed, it was possible for a user with lower privileges due to improper privilege management to trigger actions with root privileges. ESET remedied this possible attack vector and has prepared new builds of its products that are no longer susceptible to this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00148 3rd percentileScored 2026-11-07
Fix Fixed Server Security for Linux (ESET): 9.1.98.0, 9.0.466.0, 8.1.823.0Endpoint Antivirus for Linux (ESET): 9.1.11.0, 9.0.10.0, 8.1.12.0+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ESET, spol. s r.o.Server Security for Linux—9.1.98.0, 9.0.466.0, 8.1.823.0Patch availableCNA
ESET, spol. s r.o.Endpoint Antivirus for Linux—9.1.11.0, 9.0.10.0, 8.1.12.0Patch availableCNA
ESET, spol. s r.o.Cyber Security—7.3.3700.0Patch availableCNA
ESET, spol. s r.o.Endpoint Antivirus for macOS—7.3.3600.0Patch availableCNA
  • Server Security for Linux VendorESET, spol. s r.o. Affected — Fixed in 9.1.98.0, 9.0.466.0, 8.1.823.0 Patch available CNA
  • Endpoint Antivirus for Linux VendorESET, spol. s r.o. Affected — Fixed in 9.1.11.0, 9.0.10.0, 8.1.12.0 Patch available CNA
  • Cyber Security VendorESET, spol. s r.o. Affected — Fixed in 7.3.3700.0 Patch available CNA
  • Endpoint Antivirus for macOS VendorESET, spol. s r.o. Affected — Fixed in 7.3.3600.0 Patch available CNA

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:eset:cyber_security:*:*:*:*:*:*:*:*7.3.0 to before 7.3.3700.0VulnerableESET, spol. s r.o.
cpe:2.3:a:eset:endpoint_antivirus:*:*:*:*:*:linux_kernel:*:*before 8.1.12.0VulnerableESET, spol. s r.o.
cpe:2.3:a:eset:endpoint_antivirus:*:*:*:*:*:macos:*:*7.0.0 to before 7.3.3600.0VulnerableESET, spol. s r.o.
cpe:2.3:a:eset:endpoint_antivirus:*:*:*:*:*:linux_kernel:*:*9.0.5.0 to before 9.0.10.0; 9.1.4.0 to before 9.1.11.0VulnerableESET, spol. s r.o.
cpe:2.3:a:eset:server_security:*:*:*:*:*:linux_kernel:*:*before 8.1.823.0; 9.0.464.0 to before 9.0.466.0; 9.1.96.0 to before 9.1.98.0VulnerableESET, spol. s r.o.
  • cpe:2.3:a:eset:cyber_security:*:*:*:*:*:*:*:* Versions 7.3.0 to before 7.3.3700.0 Vulnerable ·ESET, spol. s r.o.
  • cpe:2.3:a:eset:endpoint_antivirus:*:*:*:*:*:linux_kernel:*:* Versions before 8.1.12.0 Vulnerable ·ESET, spol. s r.o.
  • cpe:2.3:a:eset:endpoint_antivirus:*:*:*:*:*:macos:*:* Versions 7.0.0 to before 7.3.3600.0 Vulnerable ·ESET, spol. s r.o.
  • cpe:2.3:a:eset:endpoint_antivirus:*:*:*:*:*:linux_kernel:*:* Versions 9.0.5.0 to before 9.0.10.0; 9.1.4.0 to before 9.1.11.0 Vulnerable ·ESET, spol. s r.o.
  • cpe:2.3:a:eset:server_security:*:*:*:*:*:linux_kernel:*:* Versions before 8.1.823.0; 9.0.464.0 to before 9.0.466.0; 9.1.96.0 to before 9.1.98.0 Vulnerable ·ESET, spol. s r.o.

Remediation

  • Fix · CNA Server Security for Linux (ESET) Fixed in 9.1.98.0, 9.0.466.0, 8.1.823.0
  • Fix · CNA Endpoint Antivirus for Linux (ESET) Fixed in 9.1.11.0, 9.0.10.0, 8.1.12.0
  • Fix · CNA Cyber Security (ESET ) Fixed in 7.3.3700.0
  • Fix · CNA Endpoint Antivirus for macOS (ESET ) Fixed in 7.3.3600.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-2847
  2. 2026-10-03 Alias added: GHSA-5p64-g2j6-m9w7

References

Advisory 1

  • TI-2020-08204 The ESET AV parsing engine allows virus-detection bypass via a crafted BZ2 Checksum field… CVSS 3.1CRITICAL 9.8
  • TI-2020-08214 ESET Archive Support Module before 1294 allows virus-detection bypass via crafted RAR… CVSS 3.1HIGH 7.5
  • TI-2019-12384 ESET Cyber Security 6.7.900.0 for macOS allows a local attacker to execute unauthorized… CVSS 3.1HIGH 7.8
  • TI-2019-13092 ESET Cyber Security before 6.8.1.0 is vulnerable to a denial-of-service allowing any user… CVSS 3.1MEDIUM 6.5
  • TI-2019-14264 A permissions issue in ESET Cyber Security before 6.8.300.0 for macOS allows a local… CVSS 3.1MEDIUM 6.7
  • TI-2020-07405 ESET Archive Support Module before 1296 allows virus-detection bypass via a crafted… CVSS 3.1MEDIUM 5.5
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences