Technical impact
i‑PRO IP Setting Software contains an uncontrolled DLL search path that allows an attacker to load an unauthorized Dynamic Link Library. Once the malicious DLL is loaded, code can be executed with the software’s administrative privileges, leading to full system compromise. The flaw is classified as CWE‑427, representing an untrusted path used to load executable code.
Affected Systems
The vulnerability affects i‑PRO Co., Ltd.’s IP Setting Software. No specific version numbers are provided, so all installations of this product are considered potentially susceptible.
Risk and Exploitability
The CVSS score of 7 indicates a high severity, yet the EPSS indicator of less than 1% suggests a low probability of current exploitation. The flaw is not listed in CISA’s KEV catalog. Likely attack vectors involve a local user with the ability to place a crafted DLL in a directory that appears in the software’s search path, or via an existing privileged process that can influence DLL loading. Because the weakness requires administrative rights to execute arbitrary code, the potential impact is broad compromise of the affected system.
