CVE-2008-4451: eset_software system_analyzer_tool Code Injection
Vulnerability summary
CVE-2008-4451 is a high (CVSS 7.2) Code Injection vulnerability in eset_software system_analyzer_tool. EPSS estimates a 1.00% chance of exploitation in the next 30 days, higher than 62% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 06-10-2008PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
The SysInspector AntiStealth driver (esiasdrv.sys) 3.0.65535.0 in ESET System Analyzer Tool 1.1.1.0 allows local users to execute arbitrary code via a certain METHOD_NEITHER IOCTL request to \Device\esiasdrv that overwrites a pointer.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
1.00%
Chance of exploitation in the next 30 days
Percentile
62%
Versus all other CVEs
30-day change
0.00 pp
From 1.00% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (ntinternals.org)
Maturity: unknown
ESET SysInspector 1.1.1.0 - 'esiadrv.sys' (PoC)
Maturity: poc
Weaknesses
CWE · root cause- CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
- CWE-264Permissions, Privileges, and Access ControlsWeaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Affected systems
Eset_software1 product
- system_analyzer_tool1.1.1.0
1 vendor · 1 product