CVE-2019-18894
In Avast Premium Security 19.8.2393, attackers can send a specially crafted request to the local web server run by Avast Antivirus on port 27275 to support Bank Mode functionality.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.78%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
In Avast Premium Security 19.8.2393, attackers can send a specially crafted request to the local web server run by Avast Antivirus on port 27275 to support Bank Mode functionality. A flaw in the processing of a command allows execution of arbitrary OS commands with the privileges of the currently logged in user. This allows for example attackers who compromised a browser extension to escape from the browser sandbox.
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 1.78% probability · 77th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-78
- Affected
- avast/premium security
- Source
- cve@mitre.org
References
- https://palant.de/2020/01/13/pwning-avast-secure-browser-for-fun-and-profit/Exploit, Third Party Advisory
- https://palant.de/2020/01/13/pwning-avast-secure-browser-for-fun-and-profit/Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.