7.8high
CVE-2017-14010
In SpiderControl MicroBrowser Windows XP, Vista 7, 8 and 10, Versions 1.6.30.144 and prior, an uncontrolled search path element vulnerabili…
Published 8 y ago · modified 4 mo ago · JSON
CVSS
7.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.9%
percentile 80%
Public exploits
0
none known
Summary
In SpiderControl MicroBrowser Windows XP, Vista 7, 8 and 10, Versions 1.6.30.144 and prior, an uncontrolled search path element vulnerability has been identified which could be exploited by placing a specially crafted DLL file in the search path. If the malicious DLL is loaded prior to the valid DLL, an attacker could execute arbitrary code on the system.
Exploit prediction (EPSS)
1.94% probability of exploitation in the next 30 days, higher than 80% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 7.8 | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Affected products
- SpiderControl MicroBrowser
Classification
- Weakness
- CWE-427 Uncontrolled Search Path Element
References
- ics-cert.us-cert.gov /advisories/ICSA-17-292-01 · x_refsource_MISC, x_transferred
- spidercontrol.net /download/downloadarea/?lang=en · x_refsource_MISC, x_transferred
- securityfocus.com /bid/101505 · vdb-entry, x_refsource_BID, x_transferred
Sources
- CVE List: CVE-2017-14010
- NVD: CVE-2017-14010
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.