CVE-2020-11446
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedESET Antivirus and Antispyware Module module 1553 through 1560 allows a user with limited access rights to create hard links in some ESET directories and then force the product to write through these links into files that would normally not be write-able by the user, thus achieving privilege escalation.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · moderate confidenceESET Antivirus versions 1553-1560 contain a local privilege escalation vulnerability where a low-privileged user can create hard links within ESET directories, tricking the product into writing to files the user normally cannot modify. This allows the attacker to gain elevated (likely SYSTEM) privileges through hard link manipulation.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data>= 1553, <= 1560all versionsall versionsall versionsall versionsall versionsall versionsall versionsCVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Local
- Complexity
- Low
- Privileges
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify installed ESET productOpen Programs and Features (Windows) or check for ESET services (eset.exe, ekrn.exe) in Task Manager. Common install paths: C:\Program Files\ESET\ or C:\Program Files (x86)\ESET\Affected if Any ESET product from the affected list is installed
-
Determine ESET product versionRight-click the ESET icon in system tray and select About, or check version in the installed program's properties in Programs and Features, or check version info of ekrn.exe in Task ManagerAffected if Product is ESET Antivirus And Antispyware with version 1553 through 1560, OR product is any of: Endpoint Antivirus, Endpoint Security, File Security, Internet Security, Mail Security, NOD32 Antivirus, or Smart Security (all versions)
-
Verify ESET service runs with elevated privilegesRun 'sc query ekrn' (or the specific ESET service name) and check the BINARY_PATH_NAME, or use Sysinternals Process Explorer to see the user context of ekrn.exe or eset.exe processesAffected if The ESET service runs as SYSTEM or another elevated local account
-
Check hard link creation permissions on ESET directoriesUse icacls on the ESET installation directory (e.g., icacls 'C:\Program Files\ESET\') and look for permissions allowing Users or Authenticated Users to create hard links. Specifically check for SeCreateLinkPrivilege implications via effective permissions.Affected if Low-privileged users can create hard links within ESET installation directories (the directory permissions allow this and SeCreateLinkPrivilege is not restricted)
-
Confirm low-privileged user can write to ESET directoriesAs a standard (non-admin) user, attempt to create a test file or hard link in the ESET install directory, or use icacls to check if Users group has write/create permissionsAffected if Standard users have write or create permissions in ESET directories where the product writes files during operation
If any ESET product from the affected list is installed AND the ESET service runs with elevated privileges AND low-privileged users can create hard links within ESET directories, the environment is vulnerable to CVE-2020-11446 privilege escalation.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
From vendor dataUpgrade ESET to a version beyond 1560 if available, or restrict file system permissions on ESET installation directories to prevent unprivileged users from creating hard links.
- Consultation2.0 h
- Implementation4.0 h
- Testing3.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,088.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2020-11446 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2020-11446 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data