CVE-2016-9892

PoC ×2—

CVSS 3.0

5.9 medium

EPSS

2%p75

Published

Mar 2, 2017 (Mar 2, 2017)

Modified

Jun 17, 2026

Description

The esets_daemon service in ESET Endpoint Antivirus for macOS before 6.4.168.0 and Endpoint Security for macOS before 6.4.168.0 does not properly verify X.509 certificates from the edf.eset.com SSL server, which allows man-in-the-middle attackers to spoof this server and provide crafted responses to license activation requests via a self-signed certificate. NOTE: this issue can be combined with CVE-2016-0718 to execute arbitrary code remotely as root.

Vendors: eset
Products: endpoint antivirus, endpoint security
Weakness: CWE-295
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (1.7%)

In the news2 stories

Critical Flaw in ESET Antivirus Exposes Mac Users to Remote Hacking

The Hacker NewsFeb 28, 14:06 UTC · Feb 28, 2017Exploit / PoC CVE-2016-9892 CVE-2016-0718

ESET antivirus opens Macs to remote code execution

Help Net SecurityFeb 28, 00:00 UTC · Feb 28, 2017Vulnerability CVE-2016-9892 CVE-2016-0718