The esets_daemon service in ESET Endpoint Antivirus for macOS before 6.4.168.0 and Endpoint Security for macOS before 6.4.168.0 does not pro

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• eset endpoint antivirus6.3.70.1
• eset endpoint security6.3.70.1

Other highest-scoring records for the same primary product.

• CVE-2023-5594Improper following of a certificate's chain of trust in ESET security products
  34Monitor
• CVE-2024-0353Local privilege escalation in Windows products
  31Monitor
• CVE-2023-3160Local privilege escalation in security products for Windows
  31Monitor
• CVE-2021-37851Local Privilege Escalation in ESET product for Windows
  31Monitor
• CVE-2021-37852LPE in ESET products for Windows
  31Monitor
• CVE-2022-0615Use-after-free vulnerability in ESET products for Linux
  30Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

A certificate validation error is silently swallowed instead of terminating the connection. Often, code added for a test environment makes its way into production.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1override fun checkServerTrusted(chain: Array<X509Certificate>, type: String) {2  // Left empty for the test environment3}

1val client = OkHttpClient.Builder()2  .certificatePinner(3    CertificatePinner.Builder()4      .add("api.sirius.example", "sha256/…")5      .build()6  ).build()

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.