CVE-2024-42919

The vulnerability results from improper implementation of access control mechanisms in the acteScanAVReport module of the eScan management console. An attacker can send a specially crafted network request without the need for authentication, as the application does not properly verify permissions to access this component. The attack vector is network-based, requires no user interaction or special privileges, making this vulnerability particularly dangerous.

An attacker can gain unauthorized access to sensitive data, modify data or system configuration, and potentially cause service unavailability — corresponding to complete breach of confidentiality, integrity, and availability (C:H/I:H/A:H).

Apply patches available from the vendor according to references. It is also recommended to restrict access to the eScan management console at the network level (firewall) exclusively to trusted IP addresses until the fix is deployed.

eScan Management Console version 14.0.1400.2281