Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2017-2286

Untrusted search path vulnerability in NFC Port Software Version 5.5.0.6 and earlier (for RC-S310, RC-S320, RC-S330, RC-S370, RC-S380, RC-S380/S), NFC Port Software Version 5.3.6.7 and earlier (for RC-S320, RC-S310/J1C, RC-S310/ED4C), PC/SC Activator for Type B Ver.1.2.1.0 and earlier, SFCard Viewer 2 Ver.2.5.0.0 and earlier, NFC Net Installer Ver.1.1.0.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

Published

2017-08-02T16:29:00.597

Last Modified

2025-04-20T01:37:25.860

Status

Deferred

Source

[email protected]

Severity

CVSSv3.0: 7.8 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

8.6

Impact Score

10.0

Weaknesses
  • Type: Primary
    CWE-427
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System sony nfc_port_firmware ≤ 5.5.0.6 Yes
Hardware sony rc-s310 - No
Hardware sony rc-s320 - No
Hardware sony rc-s330 - No
Hardware sony rc-s370 - No
Hardware sony rc-s380 - No
Hardware sony rc-s380\/s - No
Operating System sony nfc_port_firmware ≤ 5.3.6.7 Yes
Hardware sony rc-s310\/ed4c - No
Hardware sony rc-s310\/j1c - No
Hardware sony rc-s320 - No
Operating System sony pc\/sc_activator_for_type_b ≤ 1.2.1.0 Yes
Operating System sony sfcard_viewer_2 2.5.0.0 Yes
Operating System sony nfc_net_installer ≤ 1.1.0.0 Yes
References