CVE-2025-0798
Published: 29 January 2025
Summary
CVE-2025-0798 is a high-severity Command Injection (CWE-77) vulnerability in Escanav Escan Anti-Virus. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Unix Shell (T1059.004); ranked in the top 19.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents OS command injection by requiring validation of inputs to the Quarantine Handler during rtscanner file processing.
Mandates identification, reporting, and correction of the command injection flaw in eScan Antivirus 7.0.32, including patches or workarounds.
Reduces impact of successful command injection by enforcing least privilege on the vulnerable Quarantine Handler process.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in Linux antivirus service rtscanner enables Unix Shell command execution (T1059.004), indirect command execution (T1202 as cited in advisory), and exploitation of remote service for RCE (T1210).
NVD Description
A vulnerability was found in MicroWorld eScan Antivirus 7.0.32 on Linux. It has been rated as critical. This issue affects some unknown processing of the file rtscanner of the component Quarantine Handler. The manipulation leads to os command injection. The…
more
attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Deeper analysisAI
CVE-2025-0798 is a critical OS command injection vulnerability (CWE-77, CWE-78) in MicroWorld eScan Antivirus version 7.0.32 on Linux systems. The flaw resides in the Quarantine Handler component, specifically during processing of the rtscanner file, where improper handling allows malicious input to execute arbitrary operating system commands. Rated at CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), it was published on January 29, 2025.
Remote attackers can exploit this vulnerability without privileges or user interaction, though it requires high attack complexity and is considered difficult to execute. Successful exploitation enables full system compromise, granting high-impact confidentiality, integrity, and availability violations through injected OS commands.
Advisories from VulDB and a public GitHub disclosure detail the issue, including a proof-of-concept exploit in escan_rtscanner_rce.md, but the vendor was contacted early and provided no response or patch. Security practitioners should monitor for updates, restrict access to the affected component, and consider alternative antivirus solutions until mitigation is available.
The exploit has been publicly disclosed and may be used, though its high complexity limits widespread adoption. No real-world exploitation in the wild is reported.
Details
- CWE(s)