CVE-2020-10861: 
Avast Antivirus vulnerability analysis and mitigation

An issue was discovered in Avast Antivirus before version 20. The vulnerability affects the aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe), which allows attackers to achieve Arbitrary File Deletion from Avast Program Path via RPC, when Self Defense is Enabled (NVD, MITRE).

The vulnerability exists in the aswTask RPC endpoint functionality of the Avast Service (AvastSvc.exe). The issue allows attackers to perform arbitrary file deletion operations within the Avast Program Path through RPC calls, even when the Self Defense feature is enabled. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 HIGH (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) (NVD).

The vulnerability allows attackers to delete arbitrary files from the Avast Program Path, potentially compromising the security and functionality of the antivirus software. This could lead to service disruption or potential security bypass scenarios (Github Disclosure).

The vulnerability was addressed in Avast Antivirus version 20 and later releases. Users should upgrade to the latest version of Avast Antivirus to protect against this vulnerability (NVD).