CVE-2019-18894

In Avast Premium Security 19.8.2393, attackers can send a specially crafted request to the local web server run by Avast Antivirus on port 27275 to support Bank Mode functionality. A flaw in the processing of a command allows execution of arbitrary OS commands with the privileges of the currently logged in user. This allows for example attackers who compromised a browser extension to escape from the browser sandbox.

CVSS v3.1

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2.0

9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C

EPSS

1.78% chance of exploitation in the next 30 days, 77th percentile

Published

2020-01-13

Updated

2024-08-05

Proof-of-concept exploits (1)

• https://palant.de/2020/01/13/pwning-avast-secure-browser-for-fun-and-profit/

References

• CVE Record
• NVD entry

Related

• CVE-2019-18893
• CVE-2019-18895
• CVE-2019-18890
• CVE-2019-18898
• CVE-2019-18889
• CVE-2019-18909