# CVE-2026-0392

## Summary

- **CVE ID:** CVE-2026-0392
- **Severity:** HIGH
- **CVSS Score:** 7.3 (CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
- **CWE:** CWE-494, CWE-295, CWE-347
- **Published:** Aug 3, 2026
- **Last Modified:** Aug 5, 2026

## Description

eParakstītājs 3.0 for Windows before version
1.10.0 retrieves and executes its automatic updates over a channel that is not
authenticated or integrity-protected. On each launch the application fetches an
update descriptor (XML) over TLS but accepts any TLS certificate (a permissive
TrustManager and a HostnameVerifier that always returns true), does not verify
any digital signature on the update descriptor, and does not verify the
Authenticode signature or a checksum of the downloaded installer before running
it. A man-in-the-middle attacker able to redirect www.eparaksts.lv can serve a
crafted update descriptor pointing to an attacker-controlled executable, which
the client downloads and executes, resulting in arbitrary code execution on the
victim host.

## Affected Products

- Latvijas Valsts radio un televīzijas centrs (LVRTC) — eParakstītājs 3.0 (0)

## References

- [CNA](https://www.eparaksts.lv/lv/par_mums/Jaunumi/Jauna_eParakstitajs_30_versija_1100)
- [CNA](https://cvd.cert.lv/inbox/view/vuln-all-1689187061)
- [CNA](https://offseq.com/en/research/eparakstitajs-cve-2026-0392/)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.06%
- **EPSS Percentile:** 0.0

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-11._