Security issue with the latest version of Endpoint Antivirus. efwd.exe

[Webshaun 0]

I just got an alert from Microsoft's security platform that there's a security issue with ESET Endpoint.

"Fix unquoted service path for Windows services" on path C:\Program Files\ESET\ESET Security\efwd.exe.

In the registry in paths 

Computer\HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\efwd
Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\efwd

Name: ImagePath Value: C:\Program Files\ESET\ESET Security\efwd.exe

This should have quotes.  Value should be "C:\Program Files\ESET\ESET Security\efwd.exe"

You can manually add quotes to protect yourself immediately.

 

 

[Marcos 4,844]

Please post a screenshot of the alert for clarification. I'll report your finding to developers, however, it's not a security issue since the said service does nothing. What matters is that it's registered in the registry.

[Webshaun 0]

Attached.  According to Microsoft the potential risk is "An attacker can exploit this misconfiguration in order to perform path interception to gain escalation of privileges and persistency on the machine."