Untrusted Search Path Vulnerability in SKYSEA Client View Installer
CVE-2021-20616

7.8HIGH

Key Information:

Vendor: Sky Co., Ltd.
Status: Skysea Client View
Vendor: CVE Published:; 13 January 2021

🔔 Create Sky Co., Ltd. Vulnerability Alert

What is CVE-2021-20616?

An untrusted search path vulnerability exists in the installer of SKYSEA Client View, impacting versions from Ver.1.020.05b to Ver.16.001.01g. This flaw could allow a malicious actor to execute arbitrary code and gain elevated privileges by placing a Trojan horse dynamic link library (DLL) in a designated, but untrusted, directory during the installation process. Users are strongly advised to update their installations to mitigate potential exploitation.

Affected Version(s)

SKYSEA Client View Ver.1.020.05b to Ver.16.001.01g

References

https://www.skyseaclientview.net/news/210112_01/

x_refsource_MISC

https://jvn.jp/en/jp/JVN69635538/index.html

x_refsource_MISC

CVSS V3.1

Score:

7.8

Severity:

HIGH

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Local

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jan 13, 2021
Vulnerability Reserved
Dec 17, 2020

CVE-2021-20616 Data

JSON