CVE-2026-0392
Gravedad CVSS v4.0:
ALTA
Tipo:
CWE-295
Validación incorrecta de certificados
Fecha de publicación:
03/08/2026
Última modificación:
03/08/2026
Descripción
*** Pendiente de traducción *** eParakstītājs 3.0 for Windows before version<br />
1.10.0 retrieves and executes its automatic updates over a channel that is not<br />
authenticated or integrity-protected. On each launch the application fetches an<br />
update descriptor (XML) over TLS but accepts any TLS certificate (a permissive<br />
TrustManager and a HostnameVerifier that always returns true), does not verify<br />
any digital signature on the update descriptor, and does not verify the<br />
Authenticode signature or a checksum of the downloaded installer before running<br />
it. A man-in-the-middle attacker able to redirect www.eparaksts.lv can serve a<br />
crafted update descriptor pointing to an attacker-controlled executable, which<br />
the client downloads and executes, resulting in arbitrary code execution on the<br />
victim host.
Impacto
Puntuación base 4.0
7.30
Gravedad 4.0
ALTA