Cyber Resilience

CVE-2023-5594

High

Published: 21 December 2023

Published
21 December 2023
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N
EPSS Score 0.0010 27.6th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-5594 is a high-severity Improper Certificate Validation (CWE-295) vulnerability in Eset Endpoint Antivirus. Its CVSS base score is 7.5 (High).

Operationally, ranked at the 27.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Improper validation of the server’s certificate chain in secure traffic scanning feature considered intermediate certificate signed using the MD5 or SHA1 algorithm as trusted.

CWE(s)
CWE-295

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

eset
endpoint antivirus
all versions · ≥ 10.0
eset
endpoint security
all versions
eset
file security
all versions
eset
internet security
all versions
eset
mail security
all versions
eset
nod32 antivirus
all versions
eset
security
all versions
eset
server security
all versions · ≥ 10.1
eset
smart security
all versions

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SA-19 Component Authenticity
addresses: CWE-295

When certificates are used to establish component provenance, the control requires correct certificate validation procedures.

SC-17 Public Key Infrastructure Certificates
addresses: CWE-295

Mandates approved trust anchors and issuance policies, directly preventing acceptance of unvalidated or untrusted certificates.

SC-45 System Time Synchronization
addresses: CWE-295

Correct system time is required for proper enforcement of certificate notBefore/notAfter dates and time-based revocation checks.

References