Lucene search

JpcertCVE-2021-20793

HistoryAug 26, 2021 - 2:15 a.m.

CVE-2021-20793

2021-08-2602:15:09

CWE-427

jpcert

web.nvd.nist.gov

143

cve-2021-20793

untrusted search path vulnerability

sony audio usb driver

hap music transfer

privilege escalation

code execution

CVSS2

4.4

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

53.6%

JSON

Untrusted search path vulnerability in the installer of Sony Audio USB Driver V1.10 and prior and the installer of HAP Music Transfer Ver.1.3.0 and prior allows an attacker to gain privileges and execute arbitrary code via a Trojan horse DLL in an unspecified directory.

Affected configurations

Nvd

Vulners

Node

sonyaudio_usb_driverRange≤1.10

Node

sonyhap_music_transferRange≤1.3.0

VendorProductVersionCPE
sonyaudio_usb_driver*cpe:2.3:a:sony:audio_usb_driver:*:*:*:*:*:*:*:*
sonyhap_music_transfer*cpe:2.3:a:sony:hap_music_transfer:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sony	audio_usb_driver	*	cpe:2.3:a:sony:audio_usb_driver::::::::
sony	hap_music_transfer	*	cpe:2.3:a:sony:hap_music_transfer::::::::

CNA Affected

[
  {
    "product": "The installers of multiple Sony products",
    "vendor": "Sony Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "The installer of Sony Audio USB Driver V1.10 and prior and The installer of HAP Music Transfer Ver.1.3.0 and prior"
      }
    ]
  }
]

References

jvn.jp/en/jp/JVN80288258/index.html

www.sony.co.uk/electronics/support/software/00266642

www.sony.co.uk/electronics/support/software/00266749

www.sony.co.uk/electronics/support/software/00266758

CVSS2

4.4

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

53.6%

JSON

Related for CVE-2021-20793