Multiple DLL Search Order hijacking Vulnerabilities in SanDisk Security Installer for Windows
CVE-2023-22818

7.3HIGH

Key Information:

Vendor

Sandisk

Status
Sandisk Security Installer For Windows
Vendor
CVE Published:
15 November 2023

What is CVE-2023-22818?

Multiple DLL Search Order Hijack vulnerabilities were identified in the SanDisk Security Installer for Windows. Attackers with local access may exploit these weaknesses by executing the installer while placing a malicious DLL in the same directory. This scenario could potentially allow for the execution of arbitrary code, executed with the privileges of the vulnerable application. Consequently, an attacker could gain a foothold in the compromised system, creating opportunities for further exploitation or persistence.

Affected Version(s)

SanDisk Security Installer for Windows Windows 0 < 1.0.0.25

References

https://www.westerndigital.com/support/product-security/w...

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Western Digital would like to thank Alexander Huaman Jaimes for reporting this issue
.