Insecure DLL loading in VisualView HMI - CVE-2017-6051

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU6387

Insecure DLL loading in VisualView HMI - CVE-2017-6051

Published: April 25, 2017 / Updated: April 26, 2017


Vulnerability identifier: #VU6387
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2017-6051
CWE-ID: CWE-427
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vendor: BLF-Tech LLC
Affected software:
VisualView HMI

Detailed vulnerability description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to insecure .dll loading mechanism when opening files. A remote attacker can place a file along with specially crafted .dll file on a remote SBM or WebDAV share, trick the victim into opening it and execute arbitrary code on the target system with privileges of the current victim.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


How to mitigate CVE-2017-6051

Vulnerability was identfied in version 9.9.14.0 and previous.

Update to version 10.2.15.0:
http://www.hmisys.com/downloads/VisualViewTrialInstaller.exe

Sources