CVE-2026-0392

/// Technical description

eParakstītājs 3.0 for Windows before version

1.10.0 retrieves and executes its automatic updates over a channel that is not

authenticated or integrity-protected. On each launch the application fetches an

update descriptor (XML) over TLS but accepts any TLS certificate (a permissive

TrustManager and a HostnameVerifier that always returns true), does not verify

any digital signature on the update descriptor, and does not verify the

Authenticode signature or a checksum of the downloaded installer before running

it. A man-in-the-middle attacker able to redirect www.eparaksts.lv can serve a

crafted update descriptor pointing to an attacker-controlled executable, which

the client downloads and executes, resulting in arbitrary code execution on the

victim host.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References