What’s Vulnerable › Vulnerabilities

CVE-2020-12680

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-05-08 · updated 2026-06-17

Description

Avira Free Antivirus through 15.0.2005.1866 allows local users to discover user credentials. The functions of the executable file Avira.PWM.NativeMessaging.exe are aimed at collecting credentials stored in Chrome, Firefox, Opera, and Edge. The executable does not verify the calling program and thus a request such as fetchChromePasswords or fetchCredentials will succeed. NOTE: some third parties have stated that this is "not a vulnerability.

Affected products

• AVIRA Antivirus Free Antivirus: through 15.0.2005.1866

References

• https://medium.com/%40knikolenko/avira-free-antivirus-password-collector-83452fa7f943
• https://twitter.com/taviso/status/1258448515912491026
• https://medium.com/%40knikolenko/avira-free-antivirus-password-collector-83452fa7f943
• https://twitter.com/taviso/status/1258448515912491026

Get alerted when CVE-2020-12680 or the next vulnerability affects your stack