Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2010-0705

CWE-20 — Improper Input Validation4 documents4 sources
Severity
7.2HIGH
EPSS
0.2%
top 56.92%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
Avast Avast Antivirus HomeAvast Avast Antivirus Professional
Timeline
PublishedFeb 25
Latest updateMay 2

Description

Aavmker4.sys in avast! 4.8 through 4.8.1368.0 and 5.0 before 5.0.418.0 running on Windows 2000 and XP does not properly validate input to IOCTL 0xb2d60030, which allows local users to cause a denial of service (system crash) or execute arbitrary code to gain privileges via IOCTL requests using crafted kernel addresses that trigger memory corruption.

CVSS vector

AV:L/AC:L/C:C/I:C/A:CExploitability: 3.9 | Impact: 10.0

Affected Packages2 packages

▶NVDavast/avast_antivirus_home5.0.396.0+11

🔴Vulnerability Details

2
GHSA
GHSA-pq8r-7hph-pwj2: Aavmker4↗2022-05-02
▶
CVEList
CVE-2010-0705: Aavmker4↗2010-02-25
▶

💥Exploits & PoCs

1
Exploit-DB
Avast! 4.7 - 'aavmker4.sys' Local Privilege Escalation↗2010-04-27
▶
CVE-2010-0705 (HIGH CVSS 7.2) | Aavmker4.sys in avast! 4.8 through | cvebase.io