PT-2026-25634 · Thermalright · Tr-Vision Home
Ard33
·
Publicado
2026-03-16
·
Atualizado
2026-06-08
·
CVE-2026-4255
CVSS v4.0
8.4
Alta
| Vetor | AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Thermalright TR-VISION HOME versions up to and including 2.0.5
Description
A DLL search order hijacking issue in Thermalright TR-VISION HOME on Windows (64-bit) allows a local attacker to escalate privileges through DLL side-loading. The application utilizes the default Windows search order for loading dynamic-link libraries (DLL) dependencies, which includes directories writable by non-privileged users. An attacker can place a malicious DLL with the same name as a legitimate dependency in a user-writable directory that is searched before trusted system locations. When the application, which runs with administrative privileges, is executed, the malicious DLL is loaded instead of the legitimate library, allowing attacker-controlled code to execute with elevated privileges. Successful exploitation requires placing a crafted malicious DLL in a user-writable directory within the application's DLL search path and then executing the application.
Recommendations
Versions prior to and including 2.0.5 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
LPE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Tr-Vision Home