Cyber Posture

CVE-2024-13188

MediumPublic PoC

Published: 08 January 2025

Published
08 January 2025
Modified
09 October 2025
KEV Added
—
Patch
—
CVSS Score 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0005 14.7th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may disable, degrade, or tamper with security tools or applications (e.

Security Summary

CVE-2024-13188 is a vulnerability in MicroWorld eScan Antivirus version 7.0.32 on Linux systems, affecting an unknown functionality within the /opt/MicroWorld/var/ directory of the Installation Handler component. The issue involves incorrect default permissions (CWE-266 and CWE-276), which have been rated as critical with a CVSS v3.1 base score of 5.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). The vulnerability was publicly disclosed on January 8, 2025.

Exploitation requires local access with low privileges (PR:L) and low attack complexity (AC:L), with no user interaction needed. A local attacker can manipulate the affected component to exploit the incorrect default permissions, potentially resulting in low-level impacts on confidentiality, integrity, and availability (C:L/I:L/A:L).

Advisories from VulDB and a GitHub disclosure by hawkteam404 detail the issue but note no vendor response despite early contact. No patches or specific mitigations are available, and the exploit has been publicly released, increasing the risk of use by local attackers.

Details

CWE(s)
CWE-266CWE-276

Affected Products

escanav
escan anti-virus
7.0.32

MITRE ATT&CK Enterprise Techniques

T1574.010 Services File Permissions Weakness Stealth
Adversaries may execute their own malicious payloads by hijacking the binaries used by services.
attack.mitre.org →
T1222.002 Linux and Mac Permissions Defense Impairment
Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.
attack.mitre.org →
T1685 Disable or Modify Tools Defense Impairment
Adversaries may disable, degrade, or tamper with security tools or applications (e.
attack.mitre.org →
Why these techniques?

Incorrect default permissions on /opt/MicroWorld/var/ (Linux antivirus files/databases) enable exploitation of file system permissions weakness (T1044), modification of directories/files (T1222.002), disabling AV by deleting signatures (T1562.001), and privilege escalation via overwriting service/engine libraries (T1574.010).

References