CVE-2001-1125

Symantec LiveUpdate before 1.6 does not use cryptography to ensure the integrity of download...

9.8 Critical

Symantec LiveUpdate before 1.6 does not use cryptography to ensure the integrity of download files, which allows remote attackers to execute arbitrary code via DNS spoofing of the update.symantec.com site.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

2.47%Down 4.0 points since Feb 4, 2022

What each source reports

NVD Score used 9.8

Record: CVE-2001-1125
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-494
Updated: 2026-11-02

CVE List 9.8

Record: CVE-2001-1125
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-494
Updated: 2026-11-02

EUVDEUVD-2001-1106 9.8

Record: EUVD-2001-1106
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-7rhp-mjch-qq88 9.8

Symantec LiveUpdate before 1.6 does not use cryptography to ensure the integrity of download...

Record: GHSA-7rhp-mjch-qq88
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-494
Updated: 2026-11-02

Affected products

symantec liveupdate

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2001-1125 is a critical vulnerability (CVSS 9.8) in Symantec Liveupdate, published October 5, 2001. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.47%, the 84th percentile. No source names a fixed version.