9.3

CVE-2017-2286

Untrusted search path vulnerability in NFC Port Software Version 5.5.0.6 and earlier (for RC-S310, RC-S320, RC-S330, RC-S370, RC-S380, RC-S380/S), NFC Port Software Version 5.3.6.7 and earlier (for RC-S320, RC-S310/J1C, RC-S310/ED4C), PC/SC Activator for Type B Ver.1.2.1.0 and earlier, SFCard Viewer 2 Ver.2.5.0.0 and earlier, NFC Net Installer Ver.1.1.0.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Sony ≫ Nfc Port Firmware Version <= 5.5.0.6
   Sony ≫ Rc-s310 Version-
   Sony ≫ Rc-s320 Version-
   Sony ≫ Rc-s330 Version-
   Sony ≫ Rc-s370 Version-
   Sony ≫ Rc-s380 Version-
Sony ≫ Nfc Port Firmware Version <= 5.3.6.7
   Sony ≫ Rc-s320 Version-
Sony ≫ Sfcard Viewer 2 Version2.5.0.0
Sony ≫ Nfc Net Installer Version <= 1.1.0.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.14% 0.301
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvd@nist.gov 9.3 8.6 10
AV:N/AC:M/Au:N/C:C/I:C/A:C
CWE-427 Uncontrolled Search Path Element

The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

https://jvn.jp/en/jp/JVN16136413/index.html
Third Party Advisory
VDB Entry