JVN#23766146: Passage Drive vulnerable to insufficient data verification

Passage Drive provided by Yokogawa Rental & Lease Corporation contains an insufficient data verification vulnerability for interprocess communication (CWE-20).

Impact

By running a malicious program, an arbitrary OS command may be executed with LocalSystem privilege of the Windows system where the product is running.

Solution

Update the software
Update the software to the latest version according to the information provided by the developer.
The developer has released the following versions.

• Passage Drive v1.5.1.1
• Passage Drive for Box v1.0.1

Products Affected

• Passage Drive versions v1.4.0 to v1.5.1.0
• Passage Drive for Box version v1.0.0