We want to let our community know about a security issue we’ve identified and the steps we’re taking to address it.
The issue: The Kill Switch feature (available through Comodo Cleaning Essentials and within CIS) has been found to be vulnerable. Until a permanent fix is available, we’re advising all users not to use Kill Switch.
What we’re doing:
We removed all download links for CCE which contained the vulnerable Kill Switch.
For CIS, we will be releasing an updated installer that ships without Kill Switch and without Cleaning Essentials. This removes the vulnerable component while we work on a permanent fix. Note that this new installer only affects new/future downloads — it does not change anything on versions already installed.
For existing CIS users, we will provide a script that removes both Cleaning Essentials and Kill Switch from your current CIS installation. We recommend running this script and avoiding Kill Switch until further notice.
What’s next: Once the underlying vulnerability in Kill Switch is fixed, we’ll re-enable Cleaning Essentials and reintroduce Kill Switch support within CIS.
We’ll follow up with the download link for the updated installer and the removal script as soon as they’re ready. Thank you for your patience while we get this resolved.
Thanks for letting us know! Any idea when the removal script update will be pushed out?
FYI for those with the New UI, manually clicking Update under Protection main menu will include a check for program updates. If your using the Lycia Theme, clicking the Update button in the Basic View (not the one on the Advanced View) it will also check for program updates. Otherwise, it will automatically check once a day by default.
It’ll be a program update or they have said in their post there will be a removal script.
“We’ll follow up with the download link for the updated installer and the removal script as soon as they’re ready. Thank you for your patience while we get this resolved.”
Check for program updates like I described in my post. They are still putting together script which I imagine will be a program update eventually as well as the script which they said they will post. Ask OP if you have questions about pushing out fix across multiple devices.
@pujasingh For info: KillSwitch package is still being offered in CIS 2027 Pro though it’s only been 2 days since the notice, the install of Killswitch is still possible. Do we have an ETA for when it will be disabled and the removal script and disabling of the install will be pushed out?
After downloading from this link , i installed the app. I scanned my pc with comodo cleaning essentials. After scan, restart was requested by CCE. And there was an endless loop. Nothing solved the problem but system restore.
System restore did the job. But I avoid CCE. So, there are links that are accessible that breaks PC.
It was reported here on the forum that Comodo has a serious flaw, as the existing topic already mentions.
Given the delay in releasing a fix or an update to resolve the issue, I’d really like to know what would actually happen to my computer if I used Kill Switch and Comodo Cleaning Essentials. Does anyone have an explanation for this?
I ask because I’ve been using Kill Switch and Comodo Cleaning Essentials so far, and nothing has happened.
Probably advisable not to use a part of a security product that the developers have reported as a security issue. It could be could be any number of things. It’s not a key part of CIS/CFW protections but rather a useful tool. You can use the likes of Windows Process Explorer in the meantime.
Some forum moderators or admins claim it’s working normally, but I told them it isn’t—it’s not updating to the new version.
I don’t know what else to do, because no one can seem to fix this.
Not to mention the web filter database version number: it’s stuck at 71300.
That value hasn’t changed in over two years—meaning the filter isn’t being updated, which is a very serious issue.
if, lets say, como has 1000 users. 5 are here on this forum. so, 995 are unaware of the issue with killswitch and cce, so 995 users may be still using these softwares that comodo staff said has security flaws and should not be used as they will release something to adress this, but so far, 995 users still running the security flaws softwares that are installed through cis and no moves from comodo regardless the same flaws and recomendations they posted here… see the problem?
I agree with what you said, with everything.
There is a lack of more competence to solve this problem than there are many others that have not been corrected.
But we hope to respond to what was posted on the forum.
This does not exempt other problems from having been corrected.
I only referenced that it forces it to check for program updates whereas usual update check in advanced view only checks for updates for signatures, websites and recognisers. Only @C.O.M.O.D.O_RT stated program updates were working.
Just to clarify, the CIS database updates are working as expected. However, the program update issue is still being followed up with the development team, and we’ll keep you posted once we have further updates.
As mentioned earlier, please do not install Killswitch or CCE until further notice. Thank you for your patience and understanding. @EricCryptid Thanks for support and assistance.
