ENS code injection in EPSetup.exe
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5epss 0.3%
exploitation probability
0.3%top 75% of all CVEs
observed exploitation
nono source reports it
Code Injection vulnerability in EPSetup.exe in McAfee Endpoint Security (ENS) Prior to 10.6.1 October 2019 Update allows local user to get their malicious code installed by the ENS installer via code injection into EPSetup.exe by an attacker with access to the installer.
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L
Affected products
McAfee, LLC · McAfee Endpoint Security (ENS)