CVE-2017-5176 Information

Description

A DLL Hijack issue was discovered in Rockwell Automation Connected Components Workbench (CCW). The following versions are affected: Connected Components Workbench - Developer Edition v9.01.00 and earlier: 9328-CCWDEVENE 9328-CCWDEVZHE 9328-CCWDEVFRE 9328-CCWDEVITE 9328-CCWDEVDEE 9328-CCWDEVESE and 9328-CCWDEVPTE; and Connected Components Workbench - Free Standard Edition (All Supported Languages) v9.01.00 and earlier. Certain DLLs included with versions of CCW software can be potentially hijacked to allow an attacker to gain rights to a victim’s affected personal computer. Such access rights can be at the same or potentially higher level of privileges as the compromised user account including and up to computer administrator privileges.

CVSS Vector

CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Reference

http://www.securityfocus.com/bid/97000 https://ics-cert.us-cert.gov/advisories/ICSA-17-047-01

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction Required

NONE

Scope

REQUIRED

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

7.0