CVE-2016-9892 describes a critical vulnerability in ESET Endpoint Antivirus and Endpoint Security for macOS (versions prior to 6.4.168.0) where the esets_daemon service fails to properly validate X.509 certificates from the edf.eset.com SSL server. This flaw allows a man-in-the-middle attacker to spoof the server using a self-signed certificate, potentially providing crafted responses to license activation requests. Rated with a CVSS score of 5.9 (Medium), this vulnerability has a high integrity impact and can be exploited remotely with high attack complexity, notably allowing for arbitrary code execution as root when combined with CVE-2016-0718. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion and media coverage, indicating its potential severity.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
6.3.70.1CPE matchmatch criteria | cpe:2.3:a:eset:endpoint_antivirus:6.3.70.1:*:*:*:*:macos:*:* | ||
6.3.70.1CPE matchmatch criteria | cpe:2.3:a:eset:endpoint_security:6.3.70.1:*:*:*:*:macos:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.