PT-2025-23086 · Avast · Avast Business Antivirus For Linux

Fis Securtiy · Published 2025-05-28 · Updated 2025-06-02 · CVE-2025-4134

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Avast Business Antivirus for Linux version 4.5

Description The issue is related to a lack of file validation in the do update vps function, allowing a local user to potentially spoof or tamper with update files through unverified file writes.

Recommendations For Avast Business Antivirus for Linux version 4.5, consider restricting access to the do update vps function until a patch is available. As a temporary workaround, ensure that all update files are thoroughly verified before installation to minimize the risk of exploitation.

Fix

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

BDU:2025-06281

CVE-2025-4134

Affected Products

Avast Business Antivirus For Linux

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-4134 · Security Note
• https://bdu.fstec.ru/vul/2025-06281 · Security Note
• https://afaghhosting.net/blog/cve-2025-4134-avast-business-antivirus-for-linux-file-validation-bypass · Note
• https://twitter.com/CVEnew/status/1927730784800211268 · Twitter Post
• https://twitter.com/cracbot/status/1929493251779686624 · Twitter Post
• https://twitter.com/cybercronai/status/1927950598328009182 · Twitter Post
• https://gendigital.com/us/en/contact-us/security-advisories · Note