MicroWorld eScan AV Insecure Update Mechanism Allows Man-in-the-Middle Replacement of Updates
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Spoofing, Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-295 and CWE-347.
Summary
MicroWorld eScan AV's update mechanism failed to ensure authenticity and integrity of updates: update packages were delivered and accepted without robust cryptographic verification. As a result, an on-path attacker could perform a man-in-the-middle (MitM) attack and substitute malicious update payloads for legitimate ones. The eScan AV client accepted these substituted packages and executed or loaded their components (including sideloaded DLLs and Java/installer payloads), enabling remote code execution on affected systems. MicroWorld eScan confirmed remediation of the update mechanism on 2023-07-31 but versioning details are unavailable. NOTE: MicroWorld eScan disputes the characterization in third-party reports, stating the issue relates to 2018–2019 and that controls were implemented then.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| MicroWorld Technologies | eScan AV | all versions | — | No fix listed | CNA |
- eScan AV VendorMicroWorld Technologies Affected all versions Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-13990
- 2026-10-03 Alias added: GHSA-5327-q2rh-5x5w
References
Other 5
- https://blog.avast.com/leading-the-charge-against-guptiminer
- https://securityaffairs.com/162228/breaking-news/escan-antivirus-mitm-attack.html
- https://arstechnica.com/security/2024/04/hackers-infect-users-of-antivirus-service-that-delivered-updates-over-http/
- https://www.bleepingcomputer.com/news/security/hackers-hijack-antivirus-updates-to-drop-guptiminer-malware/
- https://thehackernews.com/2024/04/escan-antivirus-update-mechanism.html
More MicroWorld Technologies vulnerabilities
- TI-2007-02598 Stack-based buffer overflow in the MicroWorld Agent service (MWAGENT.EXE) in MicroWorld… CVSS 2.0HIGH 10.0
- TI-2007-00639 The MicroWorld Agent service (MWAGENT.EXE) in MicroWorld Technologies eScan 8.0.671.1… CVSS 2.0HIGH 10.0
- TI-2021-08342 eScan Anti-Virus Local privilege escalation Vulnerability CVSS 3.1HIGH 8.8
- TI-2008-03571 Web Based Administration in MicroWorld Technologies MailScan 5.6.a espatch 1 allows… CVSS 2.0HIGH 7.5
- TI-2007-04501 MicroWorld eScan Virus Control 9.0.722.1, Anti-Virus 9.0.722.1, and Internet Security… CVSS 2.0HIGH 7.2
- TI-2008-03569 Directory traversal vulnerability in Web Based Administration in MicroWorld Technologies… CVSS 2.0MEDIUM 5.0
Sources
- CVE-2024-13990 · CVE Program
- CVE-2024-13990 · NVD
- FIRST EPSS
- GHSA-5327-q2rh-5x5w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences