DLL Injection Vulnerability in DIGSI 4 by Siemens

CVE-2020-25245

Summary

A security vulnerability has been discovered in DIGSI 4, whereby multiple folders in the system path are accessible for writing by standard users. This misconfiguration allows an attacker to place malicious DLL files in these directories. When the affected application searches for dynamic-link libraries (DLLs), it may inadvertently execute these unauthorized files under the security context of the SYSTEM account, leading to potential unauthorized access and system compromise.

References