PT-2020-10066 · Miplatform · Cymiinstaller322 Activex

Jeongun Baek · Published 2020-06-30 · Updated 2020-07-07 · CVE-2019-19161

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CyMiInstaller322 ActiveX (affected versions not specified)

Description A vulnerability in the CyMiInstaller322 ActiveX component, which is used by MIPLATFORM to download files required for application execution, allows an attacker to download randomly generated DLL files. Due to insufficient verification, MIPLATFORM loads these DLLs, potentially leading to exploitation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

CVE-2019-19161

Affected Products

Cymiinstaller322 Activex

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-19161 · Security Note
• https://osv.dev/vulnerability/CVE-2019-19161 · Vendor Advisory
• https://tobesoft.com/Index.do · Note
• https://boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35479 · Note
• https://t.me/cvenotify/4737 · Telegram Post
• https://t.me/cibsecurity/13141 · Telegram Post