CVE-2025-1367

A vulnerability was found in MicroWord eScan Antivirus 7.0.32 on Linux. It has been classified as critical. This affects the function sprintf of the component USB Password Handler. The manipulation leads to buffer overflow. An attack has to be approached locally. The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-119
• CWE-120

• https://github.com/dmknght/FIS_RnD/blob/main/escan_av_usb_protection_multiple_vulns.mdExploit, Third Party Advisory
• https://vuldb.com/?ctiid.295971Permissions Required, Third Party Advisory, VDB Entry
• https://vuldb.com/?id.295971Third Party Advisory, VDB Entry
• https://github.com/dmknght/FIS_RnD/blob/main/escan_av_usb_protection_multiple_vulns.mdExploit, Third Party Advisory

Published

Feb 17, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-13664A potential security vulnerability in Quartus® Prime Standar…6.7
• CVE-2025-13665The System Console Utility for Windows is vulnerable to a DL…6.7
• CVE-2025-13666The Helloprint plugin for WordPress is vulnerable to Missing…5.3
• CVE-2025-13667The WP Recipe Manager plugin for WordPress is vulnerable to …6.4
• CVE-2025-13668A potential security vulnerability in Quartus® Prime Pro Edi…6.7
• CVE-2025-13669Uncontrolled Search Path Element vulnerability in Altera Hig…6.7
• CVE-2025-13670The High Level Synthesis Compiler i++ command for Windows is…6.7
• CVE-2025-13671Cross-Site Request Forgery (CSRF) vulnerability in OpenText™…6.5
• CVE-2025-13672Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2025-13673The Tutor LMS – eLearning and online course solution plugin …7.5
• CVE-2025-13674BPv7 dissector crash in Wireshark 4.6.0 allows denial of ser…5.5
• CVE-2025-13675The Tiger theme for WordPress is vulnerable to Privilege Esc…9.8