DDL injection in SoMachine HVAC - CVE-2017-7966
Published: May 17, 2017 / Updated: May 18, 2017
Vulnerability identifier: #VU6601
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-7966
CWE-ID: CWE-427
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists due to uncontrolled search path element. A remote attacker can load a specially crafted DLL file from remote WebDAV or SMB resource and execute arbitrary code on the target system with privileges of the current user.
Successful exploitation of this vulnerability may result in system compromise.
The weakness exists due to uncontrolled search path element. A remote attacker can load a specially crafted DLL file from remote WebDAV or SMB resource and execute arbitrary code on the target system with privileges of the current user.
Successful exploitation of this vulnerability may result in system compromise.
Affected software
SoMachine HVAC
How to mitigate CVE-2017-7966
Update to version 2.2.