PT-2019-8692 · Inplc · Inplc Sdk Pro++1

Kotatsu Shiraki · Published 2019-01-09 · Updated 2019-01-22 · CVE-2018-0667

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions INplc SDK Express versions 3.08 and earlier INplc SDK Pro+ versions 3.08 and earlier

Description The issue is related to an untrusted search path vulnerability in the Installer of the affected software. This vulnerability allows an attacker to gain privileges by using a Trojan horse DLL in an unspecified directory.

Recommendations For INplc SDK Express versions 3.08 and earlier, update to a version later than 3.08 to resolve the issue. For INplc SDK Pro+ versions 3.08 and earlier, update to a version later than 3.08 to resolve the issue. As a temporary workaround, consider restricting access to the Installer to minimize the risk of exploitation.

Fix

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

CVE-2018-0667

Affected Products

Inplc Sdk Express

Inplc Sdk Pro+

References · 4

• http://mnc.co.jp/INplc/info_20180907_E.htm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-0667 · Security Note
• https://osv.dev/vulnerability/CVE-2018-0667 · Vendor Advisory
• https://jvn.jp/en/jp/JVN59624986/index.html · Note