PT-2025-4056 · Microworld · Escan Antivirus

Published 2025-01-29 · Updated 2025-10-09 · CVE-2025-0797

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Medium

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions MicroWorld eScan Antivirus version 7.0.32

Description The issue affects the Quarantine Handler component, specifically the file /var/Microworld/, leading to incorrect default permissions. This can be exploited locally, and the exploit has been disclosed. The vendor was contacted about the disclosure but did not respond. The attack needs to be approached locally.

Recommendations MicroWorld eScan Antivirus version 7.0.32: Update the permissions of the /var/Microworld/ file to the correct default settings to prevent exploitation.

Exploit

Fix

LPE

Incorrect Privilege Assignment

Incorrect Default Permissions

Weakness Enumeration

CWE-266

CWE-276

Related Identifiers

CVE-2025-0797

Affected Products

Escan Antivirus

References · 11

• 🔥 https://github.com/dmknght/FIS_RnD/blob/main/escan_av_incorrect_default_perms_leads_to_malware_evasion.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-0797 · Security Note
• https://osv.dev/vulnerability/CVE-2025-0797 · Vendor Advisory
• https://vuldb.com/?id.293920 · Note
• https://t.me/cvenotify/108941 · Telegram Post
• https://twitter.com/CVEnew/status/1884424350276730897 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1884448911219155194 · Twitter Post
• https://vuldb.com/?submit.484329 · Note
• https://vuldb.com/?ctiid.293920 · Note
• https://t.me/cveNotify/138072 · Telegram Post
• https://t.me/cvedetector/16665 · Telegram Post