CVE-2021-20793
Untrusted search path vulnerability in the installer of Sony Audio USB Driver V1.10 and prior and the installer of HAP Music Transfer Ver.1.3.0 and prior allows an attacker to gain privileges and execute arbitrary code via a Trojan horse DLL in an…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.32%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Untrusted search path vulnerability in the installer of Sony Audio USB Driver V1.10 and prior and the installer of HAP Music Transfer Ver.1.3.0 and prior allows an attacker to gain privileges and execute arbitrary code via a Trojan horse DLL in an unspecified directory.
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 0.32% probability · 24th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-427
- Affected
- sony/audio usb driver · sony/hap music transfer
- Source
- vultures@jpcert.or.jp
References
- https://jvn.jp/en/jp/JVN80288258/index.htmlThird Party Advisory
- https://www.sony.co.uk/electronics/support/software/00266642Product, Vendor Advisory
- https://www.sony.co.uk/electronics/support/software/00266749Product, Vendor Advisory
- https://www.sony.co.uk/electronics/support/software/00266758Product, Vendor Advisory
- https://jvn.jp/en/jp/JVN80288258/index.htmlThird Party Advisory
- https://www.sony.co.uk/electronics/support/software/00266642Product, Vendor Advisory
- https://www.sony.co.uk/electronics/support/software/00266749Product, Vendor Advisory
- https://www.sony.co.uk/electronics/support/software/00266758Product, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.