Detections
Analytics

Disc Soft DAEMON Tools Lite 12.5.0.2421 - 12.5.0.2434 Embedded Malicious Code (CVE-2026-8398)

critical Nessus Plugin ID 323022

Language:

Synopsis

An application installed on the remote Windows host is affected by an embedded malicious code vulnerability.

Description

The version of Disc Soft DAEMON Tools Lite installed on the remote Windows host is between 12.5.0.2421 and 12.5.0.2434 inclusive. It is, therefore, affected by an embedded malicious code vulnerability.

 - A supply chain attack compromised the official installation packages of DAEMON Tools Lite, distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attackers gained unauthorized access to the vendor's (AVB Disc Soft) build or distribution infrastructure and trojanized three binaries: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. These files were digitally signed with the legitimate AVB Disc Soft code-signing certificate, allowing the malicious installers to appear trustworthy and bypass signature-based detection. (CVE-2026-8398)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Reinstall DAEMON Tools Lite using a clean package (version 12.6.0.2445 or later) from the official vendor site.

See Also

https://blog.daemon-tools.cc/post/security-incident

https://nvd.nist.gov/vuln/detail/CVE-2026-8398

https://securelist.com/tr/daemon-tools-backdoor/119654/

Plugin Details

Severity: Critical

ID: 323022

File Name: disc_soft_daemon_tools_lite_CVE-2026-8398.nasl

Version: 1.2

Type: Local

Agent: windows

Family: Misc.

Published: 6/26/2026

Updated: 6/29/2026

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.9

Percentile: 99.36

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-8398

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 9.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

CVSS v4

Risk Factor: Critical

Base Score: 9.3

Threat Score: 9.3

Threat Vector: CVSS:4.0/E:A

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

CPE: cpe:/a:disc-soft:daemon_tools

Required KB Items: installed_sw/Disc Soft DAEMON Tools Lite

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 5/15/2026

Vulnerability Publication Date: 5/15/2026

CISA Known Exploited Vulnerability Due Dates: 5/30/2026

Reference Information

CVE: CVE-2026-8398