Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Endpoint Security

ESET Patches High-Severity Vulnerability in Secure Traffic Scanning Feature

ESET has patched CVE-2023-5594, a high-severity vulnerability that can cause a browser to trust websites that should not be trusted.

ESET has released patches for several of its endpoint and server security products to address a high-severity vulnerability that could have been exploited to cause web browsers to trust sites that should not be trusted.

The flaw, tracked as CVE-2023-5594, affected the SSL/TLS protocol scanning feature present in ESET products. It could have caused browsers to trust websites with certificates signed with outdated and insecure algorithms. 

“The vulnerability in the secure traffic scanning feature was caused by improper validation of the server’s certificate chain,” ESET explained in its advisory

It added, “An intermediate certificate signed using the MD5 or SHA1 algorithm was considered trusted, and thus the browser on a system with the ESET secure traffic scanning feature enabled could be caused to trust a site secured with such a certificate.”

The list of affected ESET products includes NOD32 Antivirus, Internet Security, Smart Security Premium, Security Ultimate, Endpoint Antivirus, Endpoint Security, Server Security, Mail Security, Security for Microsoft SharePoint Server, and File Security for Microsoft Azure.

Patches have been rolling out via automatic product updates since November 21 — no user interaction is required to install the fix. 

The vulnerability was reported to ESET by an individual who wished to remain anonymous. The cybersecurity firm says it’s not aware of any attacks exploiting this vulnerability. 

Related: ESET Patches High-Severity Vulnerability in Windows Applications

Advertisement. Scroll to continue reading.

Related: Serious Vulnerability Found in Imunify360 Web Server Security Product

Related: Trend Micro Patches Exploited Zero-Day Vulnerability in Endpoint Security Products

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Gain valuable insights from industry professionals who will help guide you through the intricacies of industrial cybersecurity.

Register

Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.

Register

Expert Insights

Related Content

Endpoint Security

Today, on January 10, 2023, Windows 7 Extended Security Updates (ESU) and Windows 8.1 have reached their end of support dates.

Application Security

Virtualization technology giant VMware on Tuesday shipped urgent updates to fix a trio of security problems in multiple software products, including a virtual machine...

Endpoint Security

Gigabyte has announced BIOS updates that remove a recently identified backdoor feature in hundreds of its motherboards.

Endpoint Security

Several major companies have published advisories in response to the Downfall vulnerability affecting Intel CPUs.

Application Security

Microsoft on Tuesday pushed a major Windows update to address a security feature bypass already exploited in global ransomware attacks.The operating system update, released...

CISO Strategy

Varied viewpoints as related security concepts take on similar traits create substantial confusion among security teams trying to evaluate and purchase security technologies.

Endpoint Security

The Zero Day Dilemma

Endpoint Security

When establishing visibility and security controls across endpoints, security professionals need to understand that each endpoint bears some or all responsibility for its own...