CVE-2020-25245

HIGH

DIGSI 4 < 4.94 - Unauthenticated DLL Hijacking via Writeable System Path

Title source: llm
STIX 2.1

Description

A vulnerability has been identified in DIGSI 4 (All versions < V4.94 SP1 HF 1). Several folders in the %PATH% are writeable by normal users. As these folders are included in the search for dlls, an attacker could place dlls there with code executed by SYSTEM.

References (2)

Core 2
Core References
Patch, Third Party Advisory, US Government Resource x_refsource_misc
https://us-cert.cisa.gov/ics/advisories/icsa-21-040-10

Scores

CVSS v3 7.8
EPSS 0.0004
EPSS Percentile 11.6%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-276
Status published
Products (2)
siemens/digsi_4 4.94 (2 CPE variants)
siemens/digsi_4 < 4.94
Published Feb 09, 2021
Tracked Since Feb 18, 2026