Comodo Internet Security 2025 Improper Certificate Validation Leads to RCE via Fake Update

Description Multiple vulnerabilities were found in Comodo Internet Security 2025, which can lead to: Downloading and installing updates from an untrusted server. Delivering malicious files and achieving Remote Code Execution with SYSTEM privileges via a fake update package. Path Traversal enabling Arbitrary File Write anywhere in the system, allowing persistent malware delivery. Environment Victim: Windows 10 64-bit, updated to June 12, 2025. IP address: 10.10.14.4 Comodo installer: cispremium_installer_6100_08.exe, fully updated software and signatures to June 12, 2025 (Download link: https://www.comodo.com/home/download/download.php?prod=cis) Comodo IS was using default settings, and HIPS was not enabled. Attacker: Kali machine in the same LAN as the victim, IP: 10.10.14.10 Fake update server IP: 192.168.58.192. Victim machine can connect to the fake server. Improper Certificate Validation leads to redirect update traffic to untrusted update server (CWE-295) Root-cause By default, Comodo Internet Security uses an HTTPS connection to https://download.comodo.com/ to check for updates. However, Comodo IS does not validate the SSL certificate of the connection, allowing a threat actor to perform a DNS spoofing attack to redirect update traffic to a fake update server. Steps to re-procedure 1. Setup untrusted server with local SSL Threat actor must set up an HTTPS server with Apache2 using a localhost certificate via the following steps: Generate certificate: openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout localhost.key -out "/C=VN/ST=Hanoi/L=Hanoi/O=Dev700/CN=localhost"

Goal Reached Thanks to every supporter — we hit 100%!

Comodo Internet Security 2025 Improper Certificate Validation Leads to RCE via Fake Update