CVE-2020-7360: Philips SmartControl DLL Hijacking
An Uncontrolled Search Path Element (CWE-427) vulnerability in SmartControl version 4.3.15 and versions released before April 15, 2020 may allow an authenticated user to escalate privileges by placing a specially crafted DLL file in the search path. This issue was fixed in version 1.0.7, which was released after April 15, 2020. (Note, the version numbering system changed significantly between version 4.3.15 and version 1.0.7.)
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this SmartControl vulnerability?
The vulnerability ID for this SmartControl vulnerability is CVE-2020-7360.
What is the severity of CVE-2020-7360?
CVE-2020-7360 has a severity rating of 7.3 (high).
What is the CWE ID for this vulnerability?
The CWE ID for this vulnerability is CWE-427.
How does CVE-2020-7360 affect the SmartControl software?
CVE-2020-7360 allows an authenticated user to escalate privileges by placing a specially crafted DLL file in the search path, affecting SmartControl version 4.3.15 and versions released before April 15, 2020.
How can I fix CVE-2020-7360?
To fix CVE-2020-7360, users should update to version 1.0.7 or later of SmartControl, which includes the necessary fix.