VulnerabilityModified
CVE-2018-7289
Malware with filenames containing pure UTF-16 characters can bypass detection.
LOW 3.3EPSS 1.72%
Does this matter?
Lower severity and a low EPSS score (1.72%). Track it; it rarely justifies an emergency change on its own.
Description
An issue was discovered in armadito-windows-driver/src/communication.c in Armadito 0.12.7.2. Malware with filenames containing pure UTF-16 characters can bypass detection. The user-mode service will fail to open the file for scanning after the conversion is done from Unicode to ANSI. This happens because characters that cannot be converted from Unicode are replaced with '?' characters.
- CVSS 3.0
- 3.3 LOWCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- EPSS
- 1.72% probability · 76th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-172
- Affected
- teclib-edition/armadito antivirus
- Source
- cve@mitre.org
References
- https://github.com/armadito/armadito-windows-driver/issues/5Third Party Advisory
- https://www.exploit-db.com/exploits/44169/Exploit, Third Party Advisory, VDB Entry
- https://github.com/armadito/armadito-windows-driver/issues/5Third Party Advisory
- https://www.exploit-db.com/exploits/44169/Exploit, Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.