Executive Summary

The CVE-2025-13818 vulnerability is a local privilege escalation issue in the ESET Management Agent for Windows. It occurs because temporary batch files used during command execution are stored in a predictable and writable location on the Windows filesystem.

An attacker with local Administrator privileges can modify these temporary batch files to alter the commands being executed. This allows the attacker to execute code with SYSTEM-level privileges, effectively escalating their privileges from Administrator to SYSTEM.

The vulnerability arises from insecure handling of these temporary batch files during command execution initiated via the ESET PROTECT Web Console.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker who already has local Administrator access to escalate their privileges to SYSTEM level, which is the highest level of privilege on a Windows system.

With SYSTEM privileges, the attacker can execute arbitrary code with full control over the affected system, potentially leading to unauthorized access, modification, or destruction of data, installation of persistent malware, or disruption of system operations.

Although exploitation requires Administrator access, the impact is significant because it allows bypassing of privilege restrictions and gaining complete control over the system.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves insecure handling of temporary batch files stored in a predictable and writable location on the Windows filesystem by the ESET Management Agent. Detection involves verifying the version of the ESET Management Agent installed on your system.

You can check the installed version of the ESET Management Agent via the ESET PROTECT Web Console to determine if it is affected (versions 12.5.2104.0 and earlier are vulnerable).

No specific commands for detecting the vulnerability or scanning for malicious modifications to temporary batch files are provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, immediately verify your ESET Management Agent version using the ESET PROTECT Web Console.

If your version is 12.5.2104.0 or earlier, upgrade the ESET Management Agent to version 13.0.1400.0 or later, where the issue has been fixed by enhancing the security of file operations during command execution.

For new installations, always use the latest installers from ESET’s official sources to ensure you have the patched version.

Useful 0 Not Useful 0