Cloudanix VulnDB

CVE-2025-1369

Medium · 4.5

CVSS

4.5

EPSS

3.0%

Published

Feb 17, 2025

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in an antivirus program on Linux computers could let a nearby attacker run unwanted commands, but doing so is quite difficult.

Exploit Available
Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
High
Impact
Other
Component
Application
Class
Command Injection
Remediation
No Fix Yet
Effort
Other
Patch risk
Other

What it actually does

The vulnerability allows local attackers to inject and execute operating system commands through manipulation of the USB Password Handler component in the affected antivirus software.

Why it matters to the business

Potential for limited local command execution on affected Linux systems running the antivirus software, though exploitation is difficult due to high complexity and no known ransomware use or widespread campaigns.

How an attack unfolds

An attacker with local access crafts malicious input to the USB Password Handler to trigger command injection. The exploit has been publicly disclosed but requires high complexity and local presence.

How to fix it

No official fixed versions are available. Contact the vendor to request a patch. Mitigate by restricting local access to systems and disabling or monitoring USB-related features where possible.

How to confirm the fix worked

Confirm exposure by reviewing the installed version of the antivirus software and testing the USB Password Handler for injection behavior. Monitor vendor communications for any future updates.

Typical attack path

  1. Obtain local access to a target system running the vulnerable antivirus
  2. Interact with the USB Password Handler component
  3. Supply crafted input containing command injection payload
  4. Trigger execution of injected operating system commands

How to detect it

Review antivirus logs and system audit trails for anomalies around USB password handling or unexpected command executions. Check for any public exploit artifacts related to the USB component.

What your security team should do

  • Prioritize contacting the vendor for a response and patch
  • Apply least-privilege principles to limit local user capabilities
  • Monitor public exploit disclosures for updates
  • Evaluate alternative antivirus products if no remediation is provided

The record

A vulnerability classified as critical was found in MicroWord eScan Antivirus 7.0.32 on Linux. Affected by this vulnerability is an unknown functionality of the component USB Password Handler. The manipulation leads to os command injection. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities