Code Execution Vulnerability in DYMO ID by Newell Brands
CVE-2026-102262
7HIGH
What is CVE-2026-102262?
The DYMO ID plugin version 1.5.1.71 by Newell Brands has a security vulnerability that could be exploited by an attacker. This vulnerability arises from the improper resolution of the Modules directory relative to the process working directory. By placing a malicious job file alongside deceptive modules or DLLs, an attacker can manipulate the working directory when the victim interacts with the job file. This could lead to unauthorized code execution at the victim's privilege level, putting sensitive information and system integrity at risk. The issue has been addressed in version 1.6.0.
Affected Version(s)
DYMO ID 1.5.1.71 < 1.6.0
DYMO ID 1.6.0
References
CVSS V4
Score:
7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Paweł Karwowski, GetResponse S.A.
Bartosz Nowicki, GetResponse S.A.