PT-2020-12254 · Fazecast · Jserialcomm

Rwincey + 1 · Published 2020-05-06 · Updated 2022-01-31 · CVE-2020-10626

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fazecast jSerialComm versions 2.2.2 and prior

Description An uncontrolled search path element issue could allow a malicious DLL file with the same name as any resident DLLs inside the software installation to execute arbitrary code.

Recommendations For Fazecast jSerialComm versions 2.2.2 and prior, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2020-10626

ZDI-20-588

Affected Products

Jserialcomm

References · 5

• https://osv.dev/vulnerability/CVE-2020-10626 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-10626 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-20-588 · Security Note
• https://us-cert.gov/ics/advisories/ICSA2012601 · Note
• https://t.me/cvenotify/3784 · Telegram Post