CVE-2018-16156CWE-426

CVE-2018-16156

High · published May 17, 2019

CVSS v3.1
7.8
EPSS
3%
Percentile
85.0
In the wild
Unconfirmed
What it is

In PaperStream IP (TWAIN) 1.42.0.5685 (Service Update 7), the FJTWSVIC service running with SYSTEM privilege processes unauthenticated messages received over the FjtwMkic_Fjicube_32 named pipe. One of these message processing functions attempts to dynamically load the UninOldIS.dll library and executes an exported function named ChangeUninstallString. The default install does not contain this library and therefore if any DLL with that name exists in any directory listed in the PATH variable, it can be used to escalate to SYSTEM level privilege.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02557 · 85.0th percentile
Weakness
CWE-426 · Untrusted Search Path
Published
2019-05-17T22:29Z
Affected products (1)
ProductVersionsFixed in
fujitsu/paperstream_ip_\(twain\)all versions—
References (4)
http://packetstormsecurity.com/files/160832/PaperStream-IP-TWAIN-1.42.0.5685-Local-Privilege-Escalation.html · [email protected]https://www.securifera.com/advisories/cve-2018-16156/ · [email protected]http://packetstormsecurity.com/files/160832/PaperStream-IP-TWAIN-1.42.0.5685-Local-Privilege-Escalation.html · af854a3a-2127-422b-91ae-364da2661108https://www.securifera.com/advisories/cve-2018-16156/ · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 17 MAY 17:20Z
    In PaperStream IP (TWAIN) 1.42.0.5685 (Service Update 7), the FJTWSVIC service running with SYSTEM privilege processes unauthenticated messages received over…
    cvelistv5