jvndb-2021-001017
Vulnerability from jvndb
Published
2021-02-04 15:42
Modified
2021-02-04 15:42
Severity ?
Summary
Trend Micro HouseCall for Home Networks (Windows Edition) may insecurely load Dynamic Link Libraries
Details
HouseCall for Home Networks (Windows Edition) provided by Trend Micro Incorporated contains an issue with the DLL search path. By reading a malicious DLL placed in the folder specified by the PATH environment variable, arbitrary code with an escalated privilege may be executed (CWE-427).
Trend Micro Incorporated reported this vulnerability to JPCERT/CC to notify users of its solution through JVN.
References
| ▼ | Type | URL |
|---|---|---|
| JVN | https://jvn.jp/en/vu/JVNVU98209799/index.html | |
| JVN | https://jvn.jp/en/ta/JVNTA91240916/ | |
| CVE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25247 | |
| NVD | https://nvd.nist.gov/vuln/detail/CVE-2021-25247 | |
| Uncontrolled Search Path Element(CWE-427) | https://cwe.mitre.org/data/definitions/427.html |
Impacted products
| ▼ | Vendor | Product |
|---|---|---|
| Trend Micro, Inc. | HouseCall for Home Networks |
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-001017.html",
"dc:date": "2021-02-04T15:42+09:00",
"dcterms:issued": "2021-02-04T15:42+09:00",
"dcterms:modified": "2021-02-04T15:42+09:00",
"description": "HouseCall for Home Networks (Windows Edition) provided by Trend Micro Incorporated contains an issue with the DLL search path. By reading a malicious DLL placed in the folder specified by the PATH environment variable, arbitrary code with an escalated privilege may be executed (CWE-427).\r\n\r\nTrend Micro Incorporated reported this vulnerability to JPCERT/CC to notify users of its solution through JVN.",
"link": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-001017.html",
"sec:cpe": {
"#text": "cpe:/a:trendmicro:housecall_for_home_networks",
"@product": "HouseCall for Home Networks",
"@vendor": "Trend Micro, Inc.",
"@version": "2.2"
},
"sec:cvss": [
{
"@score": "4.4",
"@severity": "Medium",
"@type": "Base",
"@vector": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
"@version": "2.0"
},
{
"@score": "7.8",
"@severity": "High",
"@type": "Base",
"@vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"@version": "3.0"
}
],
"sec:identifier": "JVNDB-2021-001017",
"sec:references": [
{
"#text": "https://jvn.jp/en/vu/JVNVU98209799/index.html",
"@id": "JVNVU#98209799",
"@source": "JVN"
},
{
"#text": "https://jvn.jp/en/ta/JVNTA91240916/",
"@id": "JVNTA#91240916",
"@source": "JVN"
},
{
"#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25247",
"@id": "CVE-2021-25247",
"@source": "CVE"
},
{
"#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-25247",
"@id": "CVE-2021-25247",
"@source": "NVD"
},
{
"#text": "https://cwe.mitre.org/data/definitions/427.html",
"@id": "CWE-427",
"@title": "Uncontrolled Search Path Element(CWE-427)"
}
],
"title": "Trend Micro HouseCall for Home Networks (Windows Edition) may insecurely load Dynamic Link Libraries"
}
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.