Untrusted search path vulnerability in Multiple Yayoi 17 Series products (Yayoi Kaikei 17 Series Ver.23.1.1 and earlier, Yayoi Aoiro Shinko…

Published 8 y ago 2018-09-07 · modified 4 mo ago 2026-06-17 · JSON

CVSS

7.8

v3.0 · NVD

CISA KEV

not known exploited

EPSS

1.2%

percentile 68%

Public exploits

none known

Untrusted search path vulnerability in Multiple Yayoi 17 Series products (Yayoi Kaikei 17 Series Ver.23.1.1 and earlier, Yayoi Aoiro Shinkoku 17 Ver.23.1.1 and earlier, Yayoi Kyuuyo 17 Ver.20.1.4 and earlier, Yayoi Kyuuyo Keisan 17 Ver.20.1.4 and earlier, Yayoi Hanbai 17 Series Ver.20.0.2 and earlier, and Yayoi Kokyaku Kanri 17 Ver.11.0.2 and earlier) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. This flaw exists within the handling of ykkapi.dll loaded by the vulnerable products.

Exploit prediction (EPSS)

1.19% probability of exploitation in the next 30 days, higher than 68% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	7.8	`CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`
NVD	2.0	6.8	`AV:N/AC:M/Au:N/C:P/I:P/A:P`

Affected products

Yayoi Co., Ltd. Multiple Yayoi 17 Series products

Classification

Weakness

CWE-426 Untrusted Search Path

References

jvn.jp /en/jp/JVN06813756/index.html · third-party-advisory, x_refsource_JVN, x_transferred

Sources

CVE List: CVE-2018-0624
NVD: CVE-2018-0624

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.