CVE-2024-13990 Details

A vulnerability in the update mechanism of MicroWorld eScan Antivirus has been identified, allowing for man-in-the-middle (MitM) attacks. The issue arises because update packages were delivered over HTTP without proper cryptographic verification, enabling attackers to intercept and replace legitimate update payloads with malicious ones. This vulnerability has been exploited to distribute GuptiMiner malware, which installs backdoors and cryptocurrency miners on infected systems. eScan has confirmed that the vulnerability was addressed on July 31, 2023, but new infections continue to be observed, likely from users with outdated versions of the software.

Users are advised to update to the latest version of eScan Antivirus, which is not vulnerable to this issue. For those who have been infected with GuptiMiner, running a comprehensive scan with an updated antivirus program should help detect and remove the malware.