🎯Basically, a flaw in AVAST Antivirus lets users run harmful code as an administrator.
The Flaw
AVAST Antivirus version 25.11 has been found to contain a critical unquoted service path vulnerability. This issue arises when the service path is not properly quoted, allowing attackers to exploit it. Specifically, local non-privileged users can execute malicious code with elevated SYSTEM privileges.
What's at Risk
The vulnerability allows attackers to inject malicious executables into the service path, which will be executed with high-level system permissions. This could lead to a complete system compromise, making it a significant risk for users of AVAST Antivirus.
Patch Status
Currently, there is no CVE assigned to this vulnerability, and it remains unpatched. Users are advised to monitor for updates from AVAST regarding this issue.
Immediate Actions
To mitigate the risk, users should: This vulnerability highlights the importance of proper service configuration in software applications. Users are encouraged to take proactive measures to secure their systems against potential exploits.
Containment
- 1.Review service paths for unquoted entries in their AVAST installation.
- 2.Limit user privileges on systems running AVAST Antivirus to prevent unauthorized access.
Remediation
🔒 Pro insight: The unquoted service path vulnerability in AVAST could lead to widespread exploitation if not addressed promptly, especially in enterprise environments.
