Threat database

Newell Brands DYMO ID versions 1.5.1.71 up to but not including 1.6.0 contain a vulnerability where the plugin Modules directory is resolved relative to the process working directory. This allows an attacker to place a malicious job file and DLL in the same folder, causing code execution at the victim's privilege level when the job file is opened. The issue is fixed in version 1.6.0.

Newell Brands DYMO ID versions from 1.5.1.71 up to but not including 1.6.0 contain an XML External Entity (XXE) vulnerability due to improper restriction of XML external entity references. The application parses job files using XmlDocument.Load() without disabling DTD processing, which allows crafted files on browsed network shares to trigger server-side request forgery (SSRF), capture NTLMv2 credentials, read local files, or cause application crashes. This vulnerability is fixed in version 1.6.0.

The LoadImageAsPngBase64 endpoint of the Newell Brands DYMO Connect Desktop local web service accepts a file path parameter without adequate validation, allowing a crafted path to read arbitrary image files from the host filesystem outside the intended scope. Fixed in 1.6.2. The fix limits access by file extension only, not by directory - arbitrary-location reads of files with an allowed image extension remain possible by design (accepted residual risk).