VulnerabilityDeferred

CVE-2026-0392

eParakstītājs 3.0 for Windows before version 1.10.0 retrieves and executes its automatic updates over a channel that is not authenticated or integrity-protected.

HIGH 7.3EPSS 0.06%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.06%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

eParakstītājs 3.0 for Windows before version 1.10.0 retrieves and executes its automatic updates over a channel that is not authenticated or integrity-protected. On each launch the application fetches an update descriptor (XML) over TLS but accepts any TLS certificate (a permissive TrustManager and a HostnameVerifier that always returns true), does not verify any digital signature on the update descriptor, and does not verify the Authenticode signature or a checksum of the downloaded installer before running it. A man-in-the-middle attacker able to redirect www.eparaksts.lv can serve a crafted update descriptor pointing to an attacker-controlled executable, which the client downloads and executes, resulting in arbitrary code execution on the victim host.

CVSS 4.0: 7.3 HIGHCVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.06% probability · 0th percentile
CISA KEV: Not listed
Weakness: CWE-295, CWE-347, CWE-494
Source: a6d3dc9e-0591-4a13-bce7-0f5b31ff6158

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.