CVE-2020-10180

Estado: ModificadaCrítica (9.8)—

The ESET AV parsing engine allows virus-detection bypass via a crafted BZ2 Checksum field in an archive. This affects versions before 1294 of Smart Security Premium, Internet Security, NOD32 Antivirus, Cyber Security Pro (macOS), Cyber Security (macOS), Mobile Security for Android, Smart TV Security, and NOD32 Antivirus 4 for Linux Desktop.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 9.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 1.69%
Percentil entre todas las CVEs puntuadas: 76
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (5)

Eset — Cyber Security Eset — Mobile Security Eset — Nod32 Antivirus Eset — Smart Security Eset — Smart TV Security

CWE

CWE-436

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2020-10180",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-03-05T19:15:11.467",
  "references": [
    {
      "url": "https://blog.zoller.lu/p/tzo-11-2020-eset-generic-malformed.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://blog.zoller.lu/p/tzo-11-2020-eset-generic-malformed.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-436"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The ESET AV parsing engine allows virus-detection bypass via a crafted BZ2 Checksum field in an archive. This affects versions before 1294 of Smart Security Premium, Internet Security, NOD32 Antivirus, Cyber Security Pro (macOS), Cyber Security (macOS), Mobile Security for Android, Smart TV Security, and NOD32 Antivirus 4 for Linux Desktop."
    },
    {
      "lang": "es",
      "value": "El motor de análisis de ESET AV, permite omitir la detección de virus por medio de un campo BZ2 Checksum diseñado en un archivo. Esto afecta a las versiones anteriores a 1294 de Smart Security Premium, Internet Security, NOD32 Antivirus, Cyber Security Pro (macOS), Cyber Security (macOS), Mobile Security for Android, Smart TV Security y NOD32 Antivirus 4 para Linux Desktop."
    }
  ],
  "lastModified": "2026-06-17T02:47:27.130",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:eset:cyber_security:*:*:*:*:*:macos:*:*",
              "vulnerable": true,
              "matchCriteriaId": "873A6C9F-D339-492F-9234-727BD59D49AE",
              "versionEndExcluding": "1294"
            },
            {
              "criteria": "cpe:2.3:a:eset:cyber_security:*:*:*:*:pro:macos:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F948F4A7-7F14-457F-B7F1-C11CCF21442B",
              "versionEndExcluding": "1294"
            },
            {
              "criteria": "cpe:2.3:a:eset:mobile_security:*:*:*:*:*:android:*:*",
              "vulnerable": true,
              "matchCriteriaId": "46BEDBE3-DB0E-4BFE-984F-DA9C1E7ECCB7",
              "versionEndExcluding": "1294"
            },
            {
              "criteria": "cpe:2.3:a:eset:nod32_antivirus:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AEBB2951-7954-4F12-954F-835FF21487B3",
              "versionEndExcluding": "1294"
            },
            {
              "criteria": "cpe:2.3:a:eset:nod32_antivirus:4:*:*:*:*:linux:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BCB077E5-6496-4FA9-A552-692A18B04287"
            },
            {
              "criteria": "cpe:2.3:a:eset:smart_security:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "20D1C7D8-52FB-4DDD-9EA3-81D4452C7947",
              "versionEndExcluding": "1294"
            },
            {
              "criteria": "cpe:2.3:a:eset:smart_security:*:*:*:*:premium:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C5D4AC1D-31F1-40A5-82AB-2250F7667553",
              "versionEndExcluding": "1294"
            },
            {
              "criteria": "cpe:2.3:a:eset:smart_tv_security:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "14871E5E-3939-421B-837F-BE9CF1416687",
              "versionEndExcluding": "1294"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}