{"id":"CVE-2025-1367","state":"PUBLISHED","title":"MicroWord eScan Antivirus USB Password sprintf buffer overflow","description":"A vulnerability was found in MicroWord eScan Antivirus 7.0.32 on Linux. It has been classified as critical. This affects the function sprintf of the component USB Password Handler. The manipulation leads to buffer overflow. An attack has to be approached locally. The vendor was contacted early about this disclosure but did not respond in any way.","publishedAt":"2025-02-17T00:31:03.915Z","updatedAt":"2025-02-18T19:33:23.455Z","severity":{"score":4.8,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","source":"VulDB"},"assigner":"VulDB","products":["MicroWord eScan Antivirus"],"affected":[{"vendor":"MicroWord","product":"eScan Antivirus","versions":[{"version":"7.0.32","status":"affected"}],"modules":["USB Password Handler"]}],"references":["https://vuldb.com/?id.295971","https://vuldb.com/?ctiid.295971","https://github.com/dmknght/FIS_RnD/blob/main/escan_av_usb_protection_multiple_vulns.md"],"weaknesses":["CWE-120","CWE-119"],"ingestedAt":"2026-10-29T20:08:39.238Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/1xxx/CVE-2025-1367.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-1367","state":"PUBLISHED","datePublished":"2025-02-17T00:31:03.915Z","dateUpdated":"2025-02-18T19:33:23.455Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2025-02-16T08:52:24.334Z"},"containers":{"cna":{"title":"MicroWord eScan Antivirus USB Password sprintf buffer overflow","descriptions":[{"lang":"en","value":"A vulnerability was found in MicroWord eScan Antivirus 7.0.32 on Linux. It has been classified as critical. This affects the function sprintf of the component USB Password Handler. The manipulation leads to buffer overflow. An attack has to be approached locally. The vendor was contacted early about this disclosure but did not respond in any way."},{"lang":"de","value":"Es wurde eine Schwachstelle in MicroWord eScan Antivirus 7.0.32 für Linux ausgemacht. Sie wurde als kritisch eingestuft. Hiervon betroffen ist die Funktion sprintf der Komponente USB Password Handler. Mittels dem Manipulieren mit unbekannten Daten kann eine buffer overflow-Schwachstelle ausgenutzt werden. Der Angriff muss lokal erfolgen."}],"affected":[{"vendor":"MicroWord","product":"eScan Antivirus","versions":[{"version":"7.0.32","status":"affected"}],"modules":["USB Password Handler"]}],"references":[{"url":"https://vuldb.com/?id.295971","name":"VDB-295971 | MicroWord eScan Antivirus USB Password sprintf buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.295971","name":"VDB-295971 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://github.com/dmknght/FIS_RnD/blob/main/escan_av_usb_protection_multiple_vulns.md","tags":["related"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":4.8,"vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":5.3,"vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":5.3,"vectorString":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":4.3,"vectorString":"AV:L/AC:L/Au:S/C:P/I:P/A:P"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-120","type":"CWE","lang":"en","description":"Buffer Overflow"}]},{"descriptions":[{"cweId":"CWE-119","type":"CWE","lang":"en","description":"Memory Corruption"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2025-02-17T00:31:03.915Z"},"timeline":[{"time":"2025-02-16T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-02-16T01:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2025-02-16T09:57:28.000Z","lang":"en","value":"VulDB entry last update"}]},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://github.com/dmknght/FIS_RnD/blob/main/escan_av_usb_protection_multiple_vulns.md","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-02-18T18:52:14.929631Z","id":"CVE-2025-1367","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-02-18T19:33:23.455Z"}}]}}}