CVE-2021-45975

{"id": "CVE-2021-45975", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2022-01-26T15:15:07.693", "references": [{"url": "https://acercsi.com", "tags": ["Broken Link"], "source": "cve@mitre.org"}, {"url": "https://aptw.tf/2022/01/20/acer-care-center-privesc.html", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://community.acer.com/en/kb/articles/14757-acer-care-center-requires-an-update-to-resolve-a-security-vulnerability", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-426"}]}], "descriptions": [{"lang": "en", "value": "In ListCheck.exe in Acer Care Center 4.x before 4.00.3038, a vulnerability in the loading mechanism of Windows DLLs could allow a local attacker to perform a DLL hijacking attack. This vulnerability is due to incorrect handling of directory search paths at run time. An attacker could exploit this vulnerability by placing a malicious DLL file on the targeted system. This file will execute when the vulnerable application launches. A successful exploit could allow the attacker to execute arbitrary code on the targeted system with local administrator privileges."}, {"lang": "es", "value": "En el archivo ListCheck.exe de Acer Care Center versiones 4.x anteriores a 4.00.3038, una vulnerabilidad en el mecanismo de carga de DLL de Windows podr\u00eda permitir a un atacante local llevar a cabo un ataque de secuestro de DLL. Esta vulnerabilidad es debido al manejo incorrecto de las rutas de b\u00fasqueda de directorios en tiempo de ejecuci\u00f3n. Un atacante podr\u00eda explotar esta vulnerabilidad al colocar un archivo DLL malicioso en el sistema objetivo. Este archivo ser\u00e1 ejecutado cuando sea iniciada la aplicaci\u00f3n vulnerable. Una explotaci\u00f3n con \u00e9xito podr\u00eda permitir al atacante ejecutar c\u00f3digo arbitrario en el sistema objetivo con privilegios de administrador local"}], "lastModified": "2022-02-02T15:51:10.403", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:acer:care_center:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "169FE4FA-ACA9-44D7-9EB1-E338B98FF4D5", "versionEndExcluding": "4.00.3038", "versionStartIncluding": "4.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}