CVE-2021-36297CWE-426

SupportAssist Client version 3.8 and 3.9 contains an Untrusted search path vulnerability that allows attackers to load an arbitrary .dll file via .dll…

High · published September 28, 2021

CVSS v3.1
7.8
EPSS
1%
Percentile
49.5
In the wild
Unconfirmed
What it is

SupportAssist Client version 3.8 and 3.9 contains an Untrusted search path vulnerability that allows attackers to load an arbitrary .dll file via .dll planting/hijacking, only by a separate administrative action that is not a default part of the SOSInstallerTool.exe installation for executing arbitrary dll's,

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00627 · 49.5th percentile
Weakness
CWE-426 · Untrusted Search Path
Published
2021-09-28T19:20Z
EPSS history
Timeline
  • 28 SEP 19:20Z
    SupportAssist Client version 3.8 and 3.9 contains an Untrusted search path vulnerability that allows attackers to load an arbitrary .dll file via .dll…
    cvelistv5