점검 대응높음KEV 미등록
CVE-2026-0392
Latvijas Valsts radio un televīzijas centrs (LVRTC) eParakstītājs 3.0 취약점
eParakstītājs 3.0 for Windows before version 1.10.0 retrieves and executes its automatic updates over a channel that is not authenticated or integrity-protected. On each launch the application fetches an update descriptor (XML) over TLS but accepts any TLS certificate (a permissive TrustManager and a HostnameVerifier that always returns true), does not verify any digital signature on the update descriptor, and does not verify the Authenticode signature or a checksum of the downloaded installer before running it. A man-in-the-middle attacker able to redirect www.eparaksts.lv can serve a craf...
- 대응 우선순위
- 점검
- CVSS
- 7.3
- EPSS
- - 백분위 -
- CISA KEV
- 미등록
- 조치 기한
- -
- 공개일
- 2026.08.03