CVE-2020-25245

2021-02-0915:38:18

CWE-276

siemens

www.cve.org

vulnerability

digsi 4

writeable folders

dlls

code execution

system

AI Score

7.6

Confidence

High

EPSS

Percentile

10.4%

JSON

A vulnerability has been identified in DIGSI 4 (All versions < V4.94 SP1 HF 1). Several folders in the %PATH% are writeable by normal users. As these folders are included in the search for dlls, an attacker could place dlls there with code executed by SYSTEM.

CNA Affected

[
  {
    "product": "DIGSI 4",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V4.94 SP1 HF 1"
      }
    ]
  }
]