Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0). Affected software does not properly secure a folder containing library files. This could allow an attacker to place a custom malicious DLL in this folder which is then run with SYSTEM rights when a service is started that requires this DLL. At the time of assigning the CVE, the affected firmware version of the component has already been superseded by succeeding mainline versions.

CVE-2022-43722 is a high-severity vulnerability affecting Siemens SICAM PAS/PQS software versions prior to 7.0. The root cause is an uncontrolled search path element (CWE-427) vulnerability, where the software does not properly secure the directory containing critical library files (DLLs). This improper security allows an attacker with limited local access to place a malicious DLL into the vulnerable folder. When the affected service starts and loads this DLL, it executes the attacker's code with SYSTEM-level privileges, effectively granting full control over the affected system. The vulnerability requires local access and user interaction to trigger the DLL loading, but no prior authentication is needed. The CVSS 3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability due to the SYSTEM-level code execution. Although no known exploits have been reported in the wild, the vulnerability poses a significant risk to industrial control systems and critical infrastructure environments that rely on SICAM PAS/PQS for power automation and substation control. Siemens has released versions 7.0 and later to address this issue, superseding the vulnerable versions. The vulnerability is particularly critical because it allows privilege escalation from local user to SYSTEM, potentially enabling attackers to disrupt or manipulate industrial processes.

Detailed information about CVE-2022-43722: CWE-427: Uncontrolled Search Path Element in Siemens SICAM PAS/PQS affecting Siemens SICAM PAS/PQS. Get real-time upd

CVE-2022-43722: CWE-427: Uncontrolled Search Path Element in Siemens SICAM PAS/PQS - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-43722: CWE-427: Uncontrolled Search Path Element in Siemens SICAM PAS/PQS

Bdrive NetDrive Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Bdrive NetDrive. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the configuration of OpenSSL. The product loads an OpenSSL configuration file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-25295.

CVE-2025-2769 is a local privilege escalation vulnerability affecting Bdrive NetDrive version 3.17.960. The root cause of this vulnerability lies in an uncontrolled search path element related to the OpenSSL configuration file used by the product. Specifically, NetDrive loads its OpenSSL configuration from an insecure location that can be manipulated by a local attacker. This improper configuration allows an attacker who already has the ability to execute code with low privileges on the affected system to escalate their privileges to SYSTEM level. The vulnerability is classified under CWE-427, which pertains to uncontrolled search path elements that can lead to execution of malicious code. Exploitation requires the attacker to have initial local code execution capabilities, but no further authentication or user interaction is necessary once that foothold is obtained. Successful exploitation enables arbitrary code execution with the highest system privileges, potentially compromising the entire system's confidentiality, integrity, and availability. As of the publication date, no public exploits or active exploitation in the wild have been reported. The vulnerability was identified and reserved by the Zero Day Initiative (ZDI) under ZDI-CAN-25295. No patches have been released yet, increasing the urgency for affected organizations to implement mitigations. The vulnerability specifically targets the way NetDrive handles OpenSSL configuration files, which is a critical component for secure communications and cryptographic operations within the product. Improper handling of these files can lead to loading malicious configurations or libraries, facilitating privilege escalation.

Detailed information about CVE-2025-2769: CWE-427: Uncontrolled Search Path Element in Bdrive NetDrive affecting Bdrive NetDrive. Get real-time updates, technic

CVE-2025-2769: CWE-427: Uncontrolled Search Path Element in Bdrive NetDrive - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-2769: CWE-427: Uncontrolled Search Path Element in Bdrive NetDrive

Bdrive NetDrive Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Bdrive NetDrive. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the configuration of OpenSSL. The product loads an OpenSSL configuration file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-25041.

CVE-2025-2768 is a local privilege escalation vulnerability affecting Bdrive's NetDrive product, specifically version 3.17.960. The root cause of this vulnerability lies in an uncontrolled search path element related to the OpenSSL configuration file used by NetDrive. The product loads the OpenSSL configuration from an unsecured location, which can be manipulated by an attacker who already has the ability to execute low-privileged code on the target system. By placing a malicious OpenSSL configuration file in this insecure path, the attacker can escalate their privileges to SYSTEM level, thereby gaining full control over the affected machine. This vulnerability is categorized under CWE-427, which refers to uncontrolled search path elements that can lead to code execution or privilege escalation. Exploitation requires local access and the ability to run code with limited privileges, but does not require user interaction beyond that. There are no known exploits in the wild at the time of this report, and no patches have been released yet. The vulnerability was reserved and published in early 2025 and was identified by the Zero Day Initiative (ZDI) as ZDI-CAN-25041. The severity is currently rated as medium, reflecting the prerequisite of local code execution and the potential impact of full SYSTEM-level compromise.

Detailed information about CVE-2025-2768: CWE-427: Uncontrolled Search Path Element in Bdrive NetDrive affecting Bdrive NetDrive. Get real-time updates, technic

CVE-2025-2768: CWE-427: Uncontrolled Search Path Element in Bdrive NetDrive - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-2768: CWE-427: Uncontrolled Search Path Element in Bdrive NetDrive

An uncontrolled search path vulnerability exists in Trellix Agent (TA) for Windows in versions prior to 5.7.8.  This allows an attacker with admin access, which is required to place the DLL in the restricted Windows System folder, to elevate their privileges to System by placing a malicious DLL there.


CVE-2022-3859 is a medium-severity vulnerability identified in the Trellix Agent (TA) for Windows versions prior to 5.7.8. The vulnerability is classified as CWE-427, which pertains to an uncontrolled search path element. Specifically, the issue arises because the Trellix Agent improperly handles the search path for DLLs, allowing an attacker with administrative privileges to place a malicious DLL in the Windows System folder. Since the Windows System folder is a protected directory, only users with admin rights can write to it. However, once a malicious DLL is placed there, the Trellix Agent can be tricked into loading this DLL, resulting in privilege escalation from an administrative user to the SYSTEM account, which has the highest level of privileges on a Windows system. This elevation of privilege can enable an attacker to execute arbitrary code with SYSTEM-level permissions, potentially leading to full system compromise. The vulnerability requires the attacker to already have administrative access to the system, which limits the initial attack vector but significantly increases the impact if exploited. There are no known exploits in the wild as of the published date (November 30, 2022), and no official patches or mitigation links were provided in the source information. The vulnerability affects Trellix Agent versions 5.x prior to 5.7.8, and the issue is specific to Windows operating systems. The vulnerability was reserved and disclosed by Trellix in early November 2022 and is recognized by CISA as an enriched vulnerability, indicating its relevance for cybersecurity monitoring and response.

Detailed information about CVE-2022-3859: CWE- 427: Uncontrolled Search Path Element in Trellix Trellix Agent affecting Trellix Trellix Agent. Get real-time upd

CVE-2022-3859: CWE- 427: Uncontrolled Search Path Element in Trellix Trellix Agent - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-3859: CWE- 427: Uncontrolled Search Path Element in Trellix Trellix Agent

An Uncontrolled Search Path Element vulnerability in B&R Industrial Automation Scene Viewer, B&R Industrial Automation Automation Runtime, B&R Industrial Automation mapp Vision, B&R Industrial Automation mapp View, B&R Industrial Automation mapp Cockpit, B&R Industrial Automation mapp Safety, B&R Industrial Automation VC4, B&R Industrial Automation APROL, B&R Industrial Automation CAN Driver, B&R Industrial Automation CAN Driver CC770, B&R Industrial Automation CAN Driver SJA1000, B&R Industrial Automation Tou0ch Lock, B&R Industrial Automation B&R Single-Touch Driver, B&R Industrial Automation Serial User Mode Touch Driver, B&R Industrial Automation Windows Settings Changer (LTSC), B&R Industrial Automation Windows Settings Changer (2019 LTSC), B&R Industrial Automation Windows 10 Recovery Solution, B&R Industrial Automation ADI driver universal, B&R Industrial Automation ADI Development Kit, B&R Industrial Automation ADI .NET SDK, B&R Industrial Automation SRAM driver, B&R Industrial Automation HMI Service Center, B&R Industrial Automation HMI Service Center Maintenance, B&R Industrial Automation Windows 10 IoT Enterprise 2019 LTSC, B&R Industrial Automation KCF Editor could allow an authenticated local attacker to execute malicious code by placing specially crafted files in the loading search path..This issue affects Scene Viewer: before 4.4.0; Automation Runtime: before J4.93; mapp Vision: before 5.26.1; mapp View: before 5.24.2; mapp Cockpit: before 5.24.2; mapp Safety: before 5.24.2; VC4: before 4.73.2; APROL: before 4.4-01; CAN Driver: before 1.1.0; CAN Driver CC770: before 3.3.0; CAN Driver SJA1000: before 1.3.0; Tou0ch Lock: before 2.1.0; B&R Single-Touch Driver: before 2.0.0; Serial User Mode Touch Driver: before 1.7.1; Windows Settings Changer (LTSC): before 3.2.0; Windows Settings Changer (2019 LTSC): before 2.2.0; Windows 10 Recovery Solution: before 3.2.0; ADI driver universal: before 3.2.0; ADI Development Kit: before 5.5.0; ADI .NET SDK: before 4.1.0; SRAM driver: before 1.2.0; HMI Service Center: before 3.1.0; HMI Service Center Maintenance: before 2.1.0; Windows 10 IoT Enterprise 2019 LTSC: through 1.1; KCF Editor: before 1.1.0.

CVE-2024-2637 is an Uncontrolled Search Path Element vulnerability (CWE-427) affecting multiple products from B&R Industrial Automation, including Scene Viewer, Automation Runtime, mapp Vision, mapp View, mapp Cockpit, mapp Safety, VC4, APROL, various CAN Drivers, Touch Lock, Single-Touch Driver, Serial User Mode Touch Driver, Windows Settings Changer variants, Windows 10 Recovery Solution, ADI drivers and SDKs, SRAM driver, HMI Service Center and Maintenance, Windows 10 IoT Enterprise 2019 LTSC, and KCF Editor. The vulnerability arises because these products improperly handle the search path used to locate executable files or libraries, allowing an authenticated local attacker to place specially crafted files in the search path. When the affected software loads resources or executables, it may inadvertently execute malicious code from these attacker-controlled locations. This can lead to local code execution with the privileges of the affected application. The vulnerability affects versions prior to specified fixed releases (e.g., Scene Viewer before 4.4.0, Automation Runtime before J4.93, etc.). Exploitation requires local authentication, meaning the attacker must have valid access to the system. There is no indication that user interaction beyond authentication is needed. No known exploits are currently reported in the wild. The vulnerability impacts the confidentiality, integrity, and availability of the affected systems by enabling unauthorized code execution, potentially allowing attackers to manipulate industrial automation processes or disrupt operations. Given the broad range of affected products used in industrial control and automation environments, this vulnerability poses a significant risk to operational technology (OT) environments relying on B&R Industrial Automation solutions.

Detailed information about CVE-2024-2637: CWE-427 Uncontrolled Search Path Element in B&R Industrial Automation Scene Viewer affecting B&R Industrial Automation

CVE-2024-2637: CWE-427 Uncontrolled Search Path Element in B&R Industrial Automation Scene Viewer - Live Threat Intelligence - Threat Radar | OffSeq.com

Title	Severity	Type	Source	Date

Threats Tagged 'cwe-427-uncontrolled-search-path-element'

Filter Threats

Threats Tagged 'cwe-427-uncontrolled-search-path-element'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility