A CWE-427: Uncontrolled Search Path Element vulnerability exists in ProSoft Configurator (v1.002 and prior), for the PMEPXM0100 (H) module, which could cause the execution of untrusted code when using double click to open a project file which may trigger execution of a malicious DLL.
Una CWE-427: Se presenta una vulnerabilidad de Elemento de Ruta de Búsqueda No Controlada en ProSoft Configurator (versiones v1.002 y anteriores), para el módulo PMEPXM0100 (H), que podría causar la ejecución de código no confiable cuando se usa un doble clic para abrir un archivo de proyecto que puede desencadenar en una ejecución de una DLL maliciosa.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | REQUIRED |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
AV:L/AC:M/Au:N/C:P/I:P/A:P
| Access Vector | LOCAL |
|---|---|
| Access Complexity | MEDIUM |
| Authentication | NONE |
| Confidentiality Impact | PARTIAL |
| Integrity Impact | PARTIAL |
| Availability Impact | PARTIAL |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-427
|
| [email protected] | Primary |
en
CWE-427
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| schneider-electric | pmepxm0100_prosoft_configurator | * | <built-in method update of dict object at 0x7e60b9fb5380> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:schneider-electric:pmepxm0100_prosoft_configurator:*:*:*:*:*:*:*:* |