PT-2025-38604 · Microworld · Escan Av

Published 2025-09-19 · Updated 2025-09-20 · CVE-2024-13990

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions MicroWorld eScan AV (affected versions not specified)

Description The update mechanism in MicroWorld eScan AV lacked proper cryptographic verification of update packages. This allowed an attacker to perform a man-in-the-middle (MitM) attack and substitute malicious update payloads for legitimate ones. The client accepted these malicious packages, executing components like sideloaded DLLs and Java/installer payloads, which enabled remote code execution. MicroWorld eScan confirmed remediation of the update mechanism on 2023-07-31.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Verification of Cryptographic Signature

Improper Certificate Validation

Weakness Enumeration

CWE-347

CWE-295

Related Identifiers

CVE-2024-13990

Affected Products

Escan Av

References · 11

• 🔥 https://gendigital.com/blog/insights/research/guptiminer-hijacking-antivirus-updates-for-distributing-backdoors-and-casual-mining · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-13990 · Security Note
• https://vulncheck.com/advisories/microworld-escan-av-insecure-update-mechanism-allows-mitm-replacement-of-updates · Note
• https://arstechnica.com/security/2024/04/hackers-infect-users-of-antivirus-service-that-delivered-updates-over-http · Note
• https://twitter.com/CVEnew/status/1969291933001338915 · Twitter Post
• https://bleepingcomputer.com/news/security/hackers-hijack-antivirus-updates-to-drop-guptiminer-malware · Note
• https://escanav.com/en/about-us/eScan-update-advisory.asp · Patch, Vendor Advisory
• https://twitter.com/CveFindCom/status/1969117402878067166 · Twitter Post
• https://thehackernews.com/2024/04/escan-antivirus-update-mechanism.html · Note
• https://securityaffairs.com/162228/breaking-news/escan-antivirus-mitm-attack.html · Note
• https://blog.avast.com/leading-the-charge-against-guptiminer · Note