High severity · published Jul 31, 2024
CVE-2024-7326
IObit DualSafe Password Manager BPL RTL120.BPL uncontrolled search path
7.8
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability classified as critical has been found in IObit DualSafe Password Manager 1.4.0.3. This affects an unknown part in the library RTL120.BPL of the component BPL Handler. The manipulation leads to uncontrolled search path. It is possible to launch the attack on the local host. The identifier VDB-273249 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DP
DualSafe Password Manager · IObit
1.4.0.3 · source: vendor, NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-7326
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-7326
Exploit
https://lab52.io/blog/dll-side-loading-through-iobit-against-colombia/
Permissions Required
https://vuldb.com/?ctiid.273249
Permissions Required
https://vuldb.com/?id.273249
Third Party Advisory
https://vuldb.com/?submit.378150