by Kastro
Paper/Archive/CVE-2021-38469

CVE-2021-38469

AUVESY Versiondog — AUVESY Versiondog

EPSS 0.6%CVSS 9.1
critical.is priorityof 100
37
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 50.4.504 × 2010.1No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Many of the services used by the affected product do not specify full paths for the DLLs they are loading. An attacker can exploit the uncontrolled search path by implanting their own DLL near the affected product’s binaries, thus hijacking the loaded DLL.

Affected

ProductAffectedFixed inSource
VersiondogAll – 8.0–CNA

Scores by source

icscert (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

References

refus-cert.cisa.gov/ics/advisories/icsa-21-292-01