CERTFR-2025-AVI-0623
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits ESET. Elles permettent à un attaquant de provoquer une élévation de privilèges et une atteinte à l'intégrité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
ESET Endpoint Security Endpoint Security versions antérieures à 11.1.2062.0 pour Windows
ESET Small Business Security Small Business Security versions antérieures à 18.2.14.0
ESET Security Security versions 11.x antérieures à 11.1.15005.0 pour Microsoft SharePoint Server
ESET Mail Security Mail Security versions 11.x antérieures à 11.1.10013 pour Microsoft Exchange Server
ESET Internet Security Internet Security versions antérieures à 18.2.14.0
ESET Server Security Server Security versions 12.x antérieures à 12.0.12005.0 pour Windows
ESET Smart Security Premium Smart Security Premium versions antérieures à 18.2.14.0
ESET Security Security versions 12.x antérieures à 12.0.15005.0 pour Microsoft SharePoint Server
ESET Safe Server Safe Server versions antérieures à 18.2.14.0
ESET Security Ultimate Security Ultimate versions antérieures à 18.2.14.0
ESET Server Security Server Security versions 11.x antérieures à 11.1.12013.0 pour Windows
ESET Mail Security Mail Security versions 12.x antérieures à 12.0.10004.0 pour Microsoft Exchange Server
ESET Endpoint Antivirus Endpoint Antivirus versions antérieures à 12.0.2058.0 pour Windows
ESET NOD32 Antivirus NOD32 Antivirus versions antérieures à 18.2.14.0
References
Bulletin de sécurité ESET ca8840 2025-07-16 vendor-advisory
Bulletin de sécurité ESET ca8838 2025-07-09 vendor-advisory

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Endpoint Security versions ant\u00e9rieures \u00e0 11.1.2062.0 pour Windows",
      "product": {
        "name": "Endpoint Security",
        "vendor": {
          "name": "ESET",
          "scada": false
        }
      }
    },
    {
      "description": "Small Business Security versions ant\u00e9rieures \u00e0 18.2.14.0",
      "product": {
        "name": "Small Business Security",
        "vendor": {
          "name": "ESET",
          "scada": false
        }
      }
    },
    {
      "description": "Security versions 11.x ant\u00e9rieures \u00e0 11.1.15005.0 pour Microsoft SharePoint Server",
      "product": {
        "name": "Security",
        "vendor": {
          "name": "ESET",
          "scada": false
        }
      }
    },
    {
      "description": "Mail Security versions 11.x ant\u00e9rieures \u00e0 11.1.10013 pour Microsoft Exchange Server",
      "product": {
        "name": "Mail Security",
        "vendor": {
          "name": "ESET",
          "scada": false
        }
      }
    },
    {
      "description": "Internet Security versions ant\u00e9rieures \u00e0 18.2.14.0",
      "product": {
        "name": "Internet Security",
        "vendor": {
          "name": "ESET",
          "scada": false
        }
      }
    },
    {
      "description": "Server Security versions 12.x ant\u00e9rieures \u00e0 12.0.12005.0 pour Windows",
      "product": {
        "name": "Server Security",
        "vendor": {
          "name": "ESET",
          "scada": false
        }
      }
    },
    {
      "description": "Smart Security Premium versions ant\u00e9rieures \u00e0 18.2.14.0",
      "product": {
        "name": "Smart Security Premium",
        "vendor": {
          "name": "ESET",
          "scada": false
        }
      }
    },
    {
      "description": "Security versions 12.x ant\u00e9rieures \u00e0 12.0.15005.0 pour Microsoft SharePoint Server",
      "product": {
        "name": "Security",
        "vendor": {
          "name": "ESET",
          "scada": false
        }
      }
    },
    {
      "description": "Safe Server versions ant\u00e9rieures \u00e0 18.2.14.0",
      "product": {
        "name": "Safe Server",
        "vendor": {
          "name": "ESET",
          "scada": false
        }
      }
    },
    {
      "description": "Security Ultimate versions ant\u00e9rieures \u00e0 18.2.14.0",
      "product": {
        "name": "Security Ultimate",
        "vendor": {
          "name": "ESET",
          "scada": false
        }
      }
    },
    {
      "description": "Server Security versions 11.x ant\u00e9rieures \u00e0 11.1.12013.0 pour Windows",
      "product": {
        "name": "Server Security",
        "vendor": {
          "name": "ESET",
          "scada": false
        }
      }
    },
    {
      "description": "Mail Security versions 12.x ant\u00e9rieures \u00e0 12.0.10004.0 pour Microsoft Exchange Server",
      "product": {
        "name": "Mail Security",
        "vendor": {
          "name": "ESET",
          "scada": false
        }
      }
    },
    {
      "description": "Endpoint Antivirus versions ant\u00e9rieures \u00e0 12.0.2058.0 pour Windows",
      "product": {
        "name": "Endpoint Antivirus",
        "vendor": {
          "name": "ESET",
          "scada": false
        }
      }
    },
    {
      "description": "NOD32 Antivirus versions ant\u00e9rieures \u00e0 18.2.14.0",
      "product": {
        "name": "NOD32 Antivirus",
        "vendor": {
          "name": "ESET",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-5028",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-5028"
    },
    {
      "name": "CVE-2025-2425",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-2425"
    }
  ],
  "initial_release_date": "2025-07-25T00:00:00",
  "last_revision_date": "2025-07-25T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0623",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-07-25T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits ESET. Elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits ESET",
  "vendor_advisories": [
    {
      "published_at": "2025-07-16",
      "title": "Bulletin de s\u00e9curit\u00e9 ESET ca8840",
      "url": "https://support-feed.eset.com/link/15370/17103529/ca8840"
    },
    {
      "published_at": "2025-07-09",
      "title": "Bulletin de s\u00e9curit\u00e9 ESET ca8838",
      "url": "https://support-feed.eset.com/link/15370/17103530/ca8838"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.