Description
Uncontrolled search path element issue exists in Pupsman versions prior to 3.9.0. If a crafted DLL file is placed in the same folder as the affected installer and the installer is executed, arbitrary code may be executed with SYSTEM privilege.
Published: 2026-07-08
Score: 8.4 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An uncontrolled search path element flaw (CWE-427) in Fuji Electric Co., Ltd Pupsman lets an attacker place a malicious DLL next to the installer. When the installer runs, it may load the DLL and execute its code with the full rights of the SYSTEM account. It is inferred that the installer resolves DLLs from the local directory before searching system directories, but this resolution order is not explicitly stated in the description.

Affected Systems

Fuji Electric Co., Ltd Pupsman versions prior to 3.9.0 are impacted. All releases older than 3.9.0 contain the vulnerable installer.

Risk and Exploitability

The CVSS score of 8.4 signals a high severity, while the EPSS score of less than 1% indicates a very low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA KEV, suggesting no widespread exploitation has been observed. The likely attack vector is local: an attacker who can write to the installer directory can drop a DLL file and trigger the flaw, resulting in SYSTEM‑level code execution.

Generated by OpenCVE AI on July 26, 2026 at 18:32 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to Pupsman 3.9.0 or later, which removes the uncontrolled DLL search path oversight.
  • Restrict write access to the installer directory so that only trusted administrators can deploy files there, preventing injection of malicious DLLs.
  • Check Fujielectric’s official website regularly for security updates and apply any available patches as soon as they are released.

Generated by OpenCVE AI on July 26, 2026 at 18:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 26 Jul 2026 19:00:00 +0000

Type Values Removed Values Added
Title Uncontrolled DLL Search Path in Fuji Electric Pupsman Allows System-Privilege Code Execution

Tue, 21 Jul 2026 04:45:00 +0000

Type Values Removed Values Added
Title Uncontrolled DLL Search Path Allows SYSTEM Privilege Escalation in Fuji Electric Pupsman Installer

Thu, 16 Jul 2026 22:30:00 +0000

Type Values Removed Values Added
Title Uncontrolled DLL Search Path Allows SYSTEM Privilege Escalation in Fuji Electric Pupsman Installer

Wed, 15 Jul 2026 14:45:00 +0000

Type Values Removed Values Added
Title Privilege Escalation via DLL Injection in Pupsman Installer

Tue, 14 Jul 2026 06:30:00 +0000

Type Values Removed Values Added
Title Privilege Escalation via DLL Injection in Pupsman Installer

Sun, 12 Jul 2026 15:15:00 +0000

Type Values Removed Values Added
Title Uncontrolled DLL Load in Pupsman Installer Allows SYSTEM Privilege Escalation

Sat, 11 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Title Uncontrolled DLL Load in Pupsman Installer Allows SYSTEM Privilege Escalation

Sat, 11 Jul 2026 05:00:00 +0000

Type Values Removed Values Added
Title DLL Search Path Exploit in Fuji Electric Pupsman Leads to System‑level Code Execution

Fri, 10 Jul 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Fujielectric
Fujielectric pupsman
Vendors & Products Fujielectric
Fujielectric pupsman

Fri, 10 Jul 2026 01:15:00 +0000

Type Values Removed Values Added
Title DLL Search Path Exploit in Fuji Electric Pupsman Leads to System‑level Code Execution

Thu, 09 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Title DLL Search Path Manipulation Leading to System Privilege Escalation

Wed, 08 Jul 2026 15:45:00 +0000

Type Values Removed Values Added
Title DLL Search Path Manipulation Leading to System Privilege Escalation

Wed, 08 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 08 Jul 2026 05:45:00 +0000

Type Values Removed Values Added
Description Uncontrolled search path element issue exists in Pupsman versions prior to 3.9.0. If a crafted DLL file is placed in the same folder as the affected installer and the installer is executed, arbitrary code may be executed with SYSTEM privilege.
Weaknesses CWE-427
References
Metrics cvssV3_0

{'score': 7.8, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Fujielectric Pupsman
cve-icon MITRE

Status: PUBLISHED

Assigner: jpcert

Published:

Updated: 2026-07-08T13:00:01.648Z

Reserved: 2026-06-28T23:50:03.147Z

Link: CVE-2026-56437

cve-icon Vulnrichment

Updated: 2026-07-08T12:59:22.707Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-26T18:45:03Z

Weaknesses
  • CWE-427

    Uncontrolled Search Path Element