CVE-2026-0392
Severity CVSS v4.0:
HIGH
Type:
CWE-295
Improper Certificate Validation
Publication date:
03/08/2026
Last modified:
03/08/2026
Description
eParakstītājs 3.0 for Windows before version<br />
1.10.0 retrieves and executes its automatic updates over a channel that is not<br />
authenticated or integrity-protected. On each launch the application fetches an<br />
update descriptor (XML) over TLS but accepts any TLS certificate (a permissive<br />
TrustManager and a HostnameVerifier that always returns true), does not verify<br />
any digital signature on the update descriptor, and does not verify the<br />
Authenticode signature or a checksum of the downloaded installer before running<br />
it. A man-in-the-middle attacker able to redirect www.eparaksts.lv can serve a<br />
crafted update descriptor pointing to an attacker-controlled executable, which<br />
the client downloads and executes, resulting in arbitrary code execution on the<br />
victim host.
Impact
Base Score 4.0
7.30
Severity 4.0
HIGH