CVE-2016-9892: eset endpoint_antivirus Improper Certificate Validation
Vulnerability summary
CVE-2016-9892 is a medium (CVSS 5.9) Improper Certificate Validation vulnerability in eset endpoint_antivirus. EPSS estimates a 1.66% chance of exploitation in the next 30 days, higher than 76.3% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 02-03-2017PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The esets_daemon service in ESET Endpoint Antivirus for macOS before 6.4.168.0 and Endpoint Security for macOS before 6.4.168.0 does not properly verify X.509 certificates from the edf.eset.com SSL server, which allows man-in-the-middle attackers to spoof this server and provide crafted responses to license activation requests via a self-signed certificate. NOTE: this issue can be combined with CVE-2016-0718 to execute arbitrary code remotely as root.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
1.66%
Chance of exploitation in the next 30 days
Percentile
76%
Versus all other CVEs
30-day change
0.00 pp
From 1.66% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (seclists.org)
Maturity: unknown
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Eset2 products
- endpoint_antivirus6.3.70.1
- endpoint_security6.3.70.1
1 vendor · 2 products
References
4 links- packetstormsecurity.com/files/141350/ESET-Endpoint-Antivirus-6-Remote-Code-Execution.htmlX Refsource MISCExploitThird Party Advisory