Improper following of a certificate's chain of trust in ESET security products
Priority LOW 37CWE-295Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-295.
Summary
Improper validation of the server’s certificate chain in secure traffic scanning feature considered intermediate certificate signed using the MD5 or SHA1 algorithm as trusted.
Why it matters now
EPSS 0.00376 31st percentileScored 2026-11-07
Fix Fixed ESET NOD32 Antivirus (ESET, spol. s r.o.): 1464ESET Internet Security (ESET, spol. s r.o.): 1464+11 more products
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ESET, spol. s r.o. | ESET NOD32 Antivirus | — | 1464 | Patch available | CNA |
| ESET, spol. s r.o. | ESET Internet Security | — | 1464 | Patch available | CNA |
| ESET, spol. s r.o. | ESET Smart Security Premium | — | 1464 | Patch available | CNA |
| ESET, spol. s r.o. | ESET Security Ultimate | — | 1464 | Patch available | CNA |
| ESET, spol. s r.o. | ESET Endpoint Antivirus | — | 1464 | Patch available | CNA |
| ESET, spol. s r.o. | ESET Endpoint Security | — | 1464 | Patch available | CNA |
| ESET, spol. s r.o. | ESET Endpoint Antivirus for Linux 10.0 and above | — | 1464 | Patch available | CNA |
| ESET, spol. s r.o. | ESET Server Security for Windows Server | — | 1464 | Patch available | CNA |
| ESET, spol. s r.o. | ESET Mail Security for Microsoft Exchange Server | — | 1464 | Patch available | CNA |
| ESET, spol. s r.o. | ESET Mail Security for IBM Domino | — | 1464 | Patch available | CNA |
| ESET, spol. s r.o. | ESET Security for Microsoft SharePoint Server | — | 1464 | Patch available | CNA |
| ESET, spol. s r.o. | ESET File Security for Microsoft Azure | — | 1464 | Patch available | CNA |
| ESET, spol. s r.o. | ESET Server Security for Linux 10.1 and above | — | 1464 | Patch available | CNA |
- ESET NOD32 Antivirus VendorESET, spol. s r.o. Affected — Fixed in 1464 Patch available CNA
- ESET Internet Security VendorESET, spol. s r.o. Affected — Fixed in 1464 Patch available CNA
- ESET Smart Security Premium VendorESET, spol. s r.o. Affected — Fixed in 1464 Patch available CNA
- ESET Security Ultimate VendorESET, spol. s r.o. Affected — Fixed in 1464 Patch available CNA
- ESET Endpoint Antivirus VendorESET, spol. s r.o. Affected — Fixed in 1464 Patch available CNA
- ESET Endpoint Security VendorESET, spol. s r.o. Affected — Fixed in 1464 Patch available CNA
- ESET Endpoint Antivirus for Linux 10.0 and above VendorESET, spol. s r.o. Affected — Fixed in 1464 Patch available CNA
- ESET Server Security for Windows Server VendorESET, spol. s r.o. Affected — Fixed in 1464 Patch available CNA
- ESET Mail Security for Microsoft Exchange Server VendorESET, spol. s r.o. Affected — Fixed in 1464 Patch available CNA
- ESET Mail Security for IBM Domino VendorESET, spol. s r.o. Affected — Fixed in 1464 Patch available CNA
- ESET Security for Microsoft SharePoint Server VendorESET, spol. s r.o. Affected — Fixed in 1464 Patch available CNA
- ESET File Security for Microsoft Azure VendorESET, spol. s r.o. Affected — Fixed in 1464 Patch available CNA
- ESET Server Security for Linux 10.1 and above VendorESET, spol. s r.o. Affected — Fixed in 1464 Patch available CNA
CPE configurations NVD · 13
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eset:endpoint_antivirus:*:*:*:*:*:linux:*:* | 10.0 | Vulnerable | ESET, spol. s r.o. |
| cpe:2.3:a:eset:endpoint_antivirus:-:*:*:*:*:windows:*:* | not specified by NVD | Vulnerable | ESET, spol. s r.o. |
| cpe:2.3:a:eset:endpoint_security:-:*:*:*:*:windows:*:* | not specified by NVD | Vulnerable | ESET, spol. s r.o. |
| cpe:2.3:a:eset:file_security:-:*:*:*:*:azure:*:* | not specified by NVD | Vulnerable | ESET, spol. s r.o. |
| cpe:2.3:a:eset:internet_security:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | ESET, spol. s r.o. |
| cpe:2.3:a:eset:mail_security:-:*:*:*:*:domino:*:* | not specified by NVD | Vulnerable | ESET, spol. s r.o. |
| cpe:2.3:a:eset:mail_security:-:*:*:*:*:exchange_server:*:* | not specified by NVD | Vulnerable | ESET, spol. s r.o. |
| cpe:2.3:a:eset:nod32_antivirus:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | ESET, spol. s r.o. |
| cpe:2.3:a:eset:security:-:*:*:*:*:sharepoint_server:*:* | not specified by NVD | Vulnerable | ESET, spol. s r.o. |
| cpe:2.3:a:eset:security:-:*:*:*:ultimate:*:*:* | not specified by NVD | Vulnerable | ESET, spol. s r.o. |
- cpe:2.3:a:eset:endpoint_antivirus:*:*:*:*:*:linux:*:* Versions 10.0 Vulnerable ·ESET, spol. s r.o.
- cpe:2.3:a:eset:endpoint_antivirus:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·ESET, spol. s r.o.
- cpe:2.3:a:eset:endpoint_security:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·ESET, spol. s r.o.
- cpe:2.3:a:eset:file_security:-:*:*:*:*:azure:*:* Versions not specified by NVD Vulnerable ·ESET, spol. s r.o.
- cpe:2.3:a:eset:internet_security:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·ESET, spol. s r.o.
- cpe:2.3:a:eset:mail_security:-:*:*:*:*:domino:*:* Versions not specified by NVD Vulnerable ·ESET, spol. s r.o.
- cpe:2.3:a:eset:mail_security:-:*:*:*:*:exchange_server:*:* Versions not specified by NVD Vulnerable ·ESET, spol. s r.o.
- cpe:2.3:a:eset:nod32_antivirus:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·ESET, spol. s r.o.
- cpe:2.3:a:eset:security:-:*:*:*:*:sharepoint_server:*:* Versions not specified by NVD Vulnerable ·ESET, spol. s r.o.
- cpe:2.3:a:eset:security:-:*:*:*:ultimate:*:*:* Versions not specified by NVD Vulnerable ·ESET, spol. s r.o.
Show 3 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eset:server_security:*:*:*:*:*:linux:*:* | 10.1 | Vulnerable | ESET, spol. s r.o. |
| cpe:2.3:a:eset:server_security:-:*:*:*:*:windows_server:*:* | not specified by NVD | Vulnerable | ESET, spol. s r.o. |
| cpe:2.3:a:eset:smart_security:-:*:*:*:premium:*:*:* | not specified by NVD | Vulnerable | ESET, spol. s r.o. |
- cpe:2.3:a:eset:server_security:*:*:*:*:*:linux:*:* Versions 10.1 Vulnerable ·ESET, spol. s r.o.
- cpe:2.3:a:eset:server_security:-:*:*:*:*:windows_server:*:* Versions not specified by NVD Vulnerable ·ESET, spol. s r.o.
- cpe:2.3:a:eset:smart_security:-:*:*:*:premium:*:*:* Versions not specified by NVD Vulnerable ·ESET, spol. s r.o.
Remediation
- Fix · CNA ESET NOD32 Antivirus (ESET, spol. s r.o.) Fixed in 1464
- Fix · CNA ESET Internet Security (ESET, spol. s r.o.) Fixed in 1464
- Fix · CNA ESET Smart Security Premium (ESET, spol. s r.o.) Fixed in 1464
- Fix · CNA ESET Security Ultimate (ESET, spol. s r.o.) Fixed in 1464
- Fix · CNA ESET Endpoint Antivirus (ESET, spol. s r.o.) Fixed in 1464
- Fix · CNA ESET Endpoint Security (ESET, spol. s r.o.) Fixed in 1464
- Fix · CNA ESET Endpoint Antivirus for Linux 10.0 and above (ESET, spol. s r.o.) Fixed in 1464
- Fix · CNA ESET Server Security for Windows Server (ESET, spol. s r.o.) Fixed in 1464
- Fix · CNA ESET Mail Security for Microsoft Exchange Server (ESET, spol. s r.o.) Fixed in 1464
- Fix · CNA ESET Mail Security for IBM Domino (ESET, spol. s r.o.) Fixed in 1464
- Fix · CNA ESET Security for Microsoft SharePoint Server (ESET, spol. s r.o.) Fixed in 1464
- Fix · CNA ESET File Security for Microsoft Azure (ESET, spol. s r.o.) Fixed in 1464
- Fix · CNA ESET Server Security for Linux 10.1 and above (ESET, spol. s r.o.) Fixed in 1464
Timeline
- 2026-10-02 Threatist record created from CVE-2023-5594
- 2026-10-03 Alias added: GHSA-4mwg-64w4-5g5m
References
More ESET, spol. s r.o. Endpoint Antivirus vulnerabilities
- TI-2024-00320 Local privilege escalation in Windows products CVSS 3.1HIGH 7.8
- TI-2023-02960 Local privilege escalation in security products for Windows CVSS 3.1HIGH 7.8
- TI-2023-02668 Local privilege escalation in ESET products for Linux and MacOS CVSS 3.1HIGH 7.8
- TI-2021-15659 LPE in ESET products for Windows CVSS 3.1HIGH 7.8
- TI-2022-00532 Use-after-free vulnerability in ESET products for Linux CVSS 3.1HIGH 7.5
- TI-2020-09185 ESET Antivirus and Antispyware Module module 1553 through 1560 allows a user with limited… CVSS 3.1HIGH 7.8
Sources
- CVE-2023-5594 · CVE Program
- CVE-2023-5594 · NVD
- FIRST EPSS
- GHSA-4mwg-64w4-5g5m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences