CVE-2020-7360 HIGH

CVE-2020-7360: Philips SmartControl DLL Hijacking

Vendor Philips
Product SmartControl
Weakness CWE-427
Published August 13, 2020
Last update September 17, 2024
View on NVD All CVEs

CVSS base score

7.4/10
Attack vector Local
Attack complexity High
Privileges required Low
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L

What the vulnerability does

01Description

An Uncontrolled Search Path Element (CWE-427) vulnerability in SmartControl version 4.3.15 and versions released before April 15, 2020 may allow an authenticated user to escalate privileges by placing a specially crafted DLL file in the search path. This issue was fixed in version 1.0.7, which was released after April 15, 2020. (Note, the version numbering system changed significantly between version 4.3.15 and version 1.0.7.)

Key dates

02Disclosure timeline

August 13, 2020 CVE published
September 17, 2024 Record updated