CVE-2017-14010
First published: Thu Apr 26 2018(Updated: )
In SpiderControl MicroBrowser Windows XP, Vista 7, 8 and 10, Versions 1.6.30.144 and prior, an uncontrolled search path element vulnerability has been identified which could be exploited by placing a specially crafted DLL file in the search path. If the malicious DLL is loaded prior to the valid DLL, an attacker could execute arbitrary code on the system.
Credit: ics-cert@hq.dhs.gov
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SpiderControl SCADA MicroBrowser | <=1.6.30.144 | |
| Microsoft Windows 10 | ||
| Microsoft Windows 7 | ||
| Microsoft Windows 8 | ||
| Microsoft Windows Vista | ||
| Microsoft Windows XP |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2017-14010?
CVE-2017-14010 is a vulnerability in SpiderControl MicroBrowser versions 1.6.30.144 and prior on Windows XP, Vista 7, 8, and 10 that allows an attacker to exploit an uncontrolled search path element.
How can an attacker exploit CVE-2017-14010?
An attacker can exploit CVE-2017-14010 by placing a specially crafted DLL file in the search path, which can be loaded prior to the valid DLLs, allowing the attacker to execute arbitrary code.
What is the severity of CVE-2017-14010?
CVE-2017-14010 has a severity rating of 7.8 (High).
Which versions of SpiderControl MicroBrowser are affected by CVE-2017-14010?
SpiderControl MicroBrowser versions 1.6.30.144 and prior are affected by CVE-2017-14010.
How can I mitigate the vulnerability CVE-2017-14010?
To mitigate CVE-2017-14010, update to a version of SpiderControl MicroBrowser that is not affected by the vulnerability and ensure that only trusted DLLs are loaded in the search path.
- collector/nvd-index
- agent/weakness
- agent/references
- agent/author
- agent/severity
- agent/type
- agent/event
- agent/description
- agent/last-modified-date
- agent/remedy
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/spidercontrol
- canonical/spidercontrol scada microbrowser
- version/spidercontrol scada microbrowser/1.6.30.144
- vendor/microsoft
- canonical/microsoft windows 10
- canonical/microsoft windows 7
- canonical/microsoft windows 8
- canonical/microsoft windows vista
- canonical/microsoft windows xp