Read the docs
TI-2023-06439 Aliases CVE-2023-7043GHSA-m5qf-4xvf-462h

Unquoted path privilege vulnerability in ESET products for Windows

Priority LOW 25CWE-428Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
None · High · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-428.

Summary

Unquoted service path in ESET products allows to drop a prepared program to a specific location and run on boot with the NT AUTHORITY\NetworkService permissions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00282 20th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ESET, spol. s r.o.ESET Endpoint Security10.1.2046.x – 10.1.2063.x—No fix listedCNA
ESET, spol. s r.o.ESET Endpoint Antivirus10.1.2046.x – 10.1.2063.x—No fix listedCNA
ESET, spol. s r.o.ESET NOD32 Antivirus16.1.14.0 – 16.2.15.0—No fix listedCNA
ESET, spol. s r.o.ESET Internet Security16.1.14.0 – 16.2.15.0—No fix listedCNA
ESET, spol. s r.o.ESET Smart Security Premium16.1.14.0 – 16.2.15.0—No fix listedCNA
ESET, spol. s r.o.ESET Mail Security for Microsoft Exchange Server10.1.10012.0—No fix listedCNA
  • ESET Endpoint Security VendorESET, spol. s r.o. Affected 10.1.2046.x – 10.1.2063.x Fixed in — No fix listed CNA
  • ESET Endpoint Antivirus VendorESET, spol. s r.o. Affected 10.1.2046.x – 10.1.2063.x Fixed in — No fix listed CNA
  • ESET NOD32 Antivirus VendorESET, spol. s r.o. Affected 16.1.14.0 – 16.2.15.0 Fixed in — No fix listed CNA
  • ESET Internet Security VendorESET, spol. s r.o. Affected 16.1.14.0 – 16.2.15.0 Fixed in — No fix listed CNA
  • ESET Smart Security Premium VendorESET, spol. s r.o. Affected 16.1.14.0 – 16.2.15.0 Fixed in — No fix listed CNA
  • ESET Mail Security for Microsoft Exchange Server VendorESET, spol. s r.o. Affected 10.1.10012.0 Fixed in — No fix listed CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:eset:endpoint_antivirus:*:*:*:*:*:*:*:*10.1.2046.0 to before 11.0.2032.0VulnerableESET, spol. s r.o.
cpe:2.3:a:eset:endpoint_security:*:*:*:*:*:*:*:*10.1.2046.0 to before 11.0.2032.0VulnerableESET, spol. s r.o.
cpe:2.3:a:eset:internet_security:*:*:*:*:*:*:*:*16.1.14.0 to before 17.0.15.0VulnerableESET, spol. s r.o.
cpe:2.3:a:eset:mail_security:10.1.10012.0:*:*:*:*:exchange_server:*:*10.1.10012.0VulnerableESET, spol. s r.o.
cpe:2.3:a:eset:nod32_antivirus:*:*:*:*:*:*:*:*16.1.14.0 to before 17.0.15.0VulnerableESET, spol. s r.o.
cpe:2.3:a:eset:smart_security_premium:*:*:*:*:*:*:*:*16.1.14.0 to before 17.0.15.0VulnerableESET, spol. s r.o.
  • cpe:2.3:a:eset:endpoint_antivirus:*:*:*:*:*:*:*:* Versions 10.1.2046.0 to before 11.0.2032.0 Vulnerable ·ESET, spol. s r.o.
  • cpe:2.3:a:eset:endpoint_security:*:*:*:*:*:*:*:* Versions 10.1.2046.0 to before 11.0.2032.0 Vulnerable ·ESET, spol. s r.o.
  • cpe:2.3:a:eset:internet_security:*:*:*:*:*:*:*:* Versions 16.1.14.0 to before 17.0.15.0 Vulnerable ·ESET, spol. s r.o.
  • cpe:2.3:a:eset:mail_security:10.1.10012.0:*:*:*:*:exchange_server:*:* Versions 10.1.10012.0 Vulnerable ·ESET, spol. s r.o.
  • cpe:2.3:a:eset:nod32_antivirus:*:*:*:*:*:*:*:* Versions 16.1.14.0 to before 17.0.15.0 Vulnerable ·ESET, spol. s r.o.
  • cpe:2.3:a:eset:smart_security_premium:*:*:*:*:*:*:*:* Versions 16.1.14.0 to before 17.0.15.0 Vulnerable ·ESET, spol. s r.o.

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-7043
  2. 2026-10-03 Alias added: GHSA-m5qf-4xvf-462h

References

Advisory 1

  • TI-2024-00320 Local privilege escalation in Windows products CVSS 3.1HIGH 7.8
  • TI-2023-05150 Improper following of a certificate's chain of trust in ESET security products CVSS 3.1HIGH 8.6
  • TI-2023-02960 Local privilege escalation in security products for Windows CVSS 3.1HIGH 7.8
  • TI-2023-02668 Local privilege escalation in ESET products for Linux and MacOS CVSS 3.1HIGH 7.8
  • TI-2021-15659 LPE in ESET products for Windows CVSS 3.1HIGH 7.8
  • TI-2022-00532 Use-after-free vulnerability in ESET products for Linux CVSS 3.1HIGH 7.5
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences