Lucene search

KrcertCVE-2020-7807

HistorySep 14, 2020 - 12:15 p.m.

CVE-2020-7807

2020-09-1412:15:11

CWE-354

CWE-353

krcert

web.nvd.nist.gov

cve-2020-7807

vulnerability

dll hijacking

lg electronics

lgpcsuite_setup

ipsfullhd

lg_ultrawide

ultra_hd_driver setup

integrity check vulnerability

nvd

CVSS2

1.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:L/AC:M/Au:N/C:N/I:P/A:N

CVSS3

5.6

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:H

AI Score

5.5

Confidence

High

EPSS

0.001

Percentile

23.6%

JSON

A vulnerability that can hijack a DLL file that is loaded during products(LGPCSuite_Setup, IPSFULLHD, LG_ULTRAWIDE, ULTRA_HD_Driver Setup) installation into a DLL file that the hacker wants. Missing Support for Integrity Check vulnerability in COMPONENT of LG Electronics (LGPCSuite_Setup), (IPSFULLHD, LG_ULTRAWIDE, ULTRA_HD_Driver Setup) allows ATTACKER/ATTACK to cause IMPACT. This issue affects: LG Electronics; LGPCSuite_Setup : 1.0.0.3 on Windows(x86, x64); IPSFULLHD, LG_ULTRAWIDE, ULTRA_HD_Driver Setup : 1.0.0.9 on Windows(x86, x64).

Affected configurations

Nvd

Node

microsoftwindowsMatch-

AND

lgipsfullhdMatch1.0.0.3

lglg_ultrawideMatch1.0.0.3

lglgpcsuite_setupMatch1.0.0.9

lgultra_hd_driver_setupMatch1.0.0.3

VendorProductVersionCPE
microsoftwindows-cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
lgipsfullhd1.0.0.3cpe:2.3:a:lg:ipsfullhd:1.0.0.3:*:*:*:*:*:*:*
lglg_ultrawide1.0.0.3cpe:2.3:a:lg:lg_ultrawide:1.0.0.3:*:*:*:*:*:*:*
lglgpcsuite_setup1.0.0.9cpe:2.3:a:lg:lgpcsuite_setup:1.0.0.9:*:*:*:*:*:*:*
lgultra_hd_driver_setup1.0.0.3cpe:2.3:a:lg:ultra_hd_driver_setup:1.0.0.3:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
microsoft	windows	-	cpe:2.3:o:microsoft:windows:-:::::::*
lg	ipsfullhd	1.0.0.3	cpe:2.3:a:lg:ipsfullhd:1.0.0.3:::::::*
lg	lg_ultrawide	1.0.0.3	cpe:2.3:a:lg:lg_ultrawide:1.0.0.3:::::::*
lg	lgpcsuite_setup	1.0.0.9	cpe:2.3:a:lg:lgpcsuite_setup:1.0.0.9:::::::*
lg	ultra_hd_driver_setup	1.0.0.3	cpe:2.3:a:lg:ultra_hd_driver_setup:1.0.0.3:::::::*

CNA Affected

[
  {
    "platforms": [
      "Windows(x86, x64)"
    ],
    "product": "(LGPCSuite_Setup), (IPSFULLHD, LG_ULTRAWIDE, ULTRA_HD_Driver Setup)",
    "vendor": "LG Electronics",
    "versions": [
      {
        "status": "affected",
        "version": "IPSFULLHD, LG_ULTRAWIDE, ULTRA_HD_Driver Setup.exe 1.0.0.3"
      },
      {
        "status": "affected",
        "version": "LGPCSuite_Setup.exe 1.0.0.9"
      }
    ]
  }
]

References

lgsecurity.lge.com/

www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35587

CVSS2

1.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:L/AC:M/Au:N/C:N/I:P/A:N

CVSS3

5.6

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:H

AI Score

5.5

Confidence

High

EPSS

0.001

Percentile

23.6%

JSON

Related for CVE-2020-7807