CVE-2025-13176

Published Jan 30, 2026

Last updated 20 days ago

ESET Inspect Connector

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-13176 is a DLL injection vulnerability found in ESET Inspect Connector for Windows. This flaw allows a local attacker to exploit improper privilege management by planting a custom configuration file. This configuration file can then enable the loading of a malicious DLL. The vulnerability stems from the application's handling of configuration files, specifically its failure to properly validate or restrict modifications that control DLL loading behavior. An attacker with local access and low-level privileges can create or modify a configuration file to point to a malicious DLL, which the application subsequently loads with elevated privileges.

Description: Planting a custom configuration file in ESET Inspect Connector allow load a malicious DLL.
Source: security@eset.com
NVD status: Awaiting Analysis

Risk scores

CVSS 4.0

Type: Secondary
Base score: 8.4
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: HIGH

Weaknesses

security@eset.com: CWE-269

Hype score: Not currently trending

References