PT-2020-14521 · Alps · Alps Alpine Touchpad Driver

Published 2020-07-21 · Updated 2021-07-21 · CVE-2020-15596

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ALPS ALPINE touchpad driver versions prior to 8.2206.1717.634

Description The issue allows attackers to conduct Path Disclosure attacks via a "fake" DLL file. This is related to a DLL hijacking issue.

Recommendations For versions prior to 8.2206.1717.634, update to version 8.2206.1717.634 or later to resolve the issue. As a temporary workaround, consider restricting the use of the ALPS ALPINE touchpad driver until a patch is available. Avoid using potentially vulnerable DLL files in the affected driver until the issue is resolved.

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2020-15596

Affected Products

Alps Alpine Touchpad Driver

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-15596 · Security Note
• https://support.hp.com/document/c06706305 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15596 · Vendor Advisory
• https://t.me/defcon_news/52616 · Telegram Post
• https://seclists.org/fulldisclosure/2020/Jul/30 · Note