The vulnerability resides in the automatic update mechanism of eParakstītājs 3.0 for Windows. The program retrieves an XML update descriptor over TLS but accepts any certificate, does not verify the digital signature of the descriptor, nor the Authenticode signature or checksum of the downloaded installer. An attacker who can redirect requests to www.eparaksts.lv can supply a malicious descriptor that points to an attacker‑controlled executable, which the client downloads and runs, leading to arbitrary code execution on the victim machine.

The affected product is eParakstītājs 3.0 distributed by Latvijas Valsts radio un televīzijas centrs (LVRTC). Versions earlier than 1.10.0 are at risk; the vulnerability exists in all builds that use the unprotected update channel.

The CVSS score of 7.3 indicates high severity, and the absence of an EPSS score notwithstanding the lack of publicly recorded exploitation evidence, the vulnerability remains a high‑risk vector because it can be leveraged from any host that can piggyback on the update channel. The flaw is listed as not included in CISA’s KEV catalog. Attackers who can perform a man‑in‑the‑middle or DNS hijack on the update path can trivially compromise an infected host without needing privileged credentials. Consequently, the risk is significant and should be mitigated as a matter of priority.