CVE-2025-4272

HIGH Year: 2025
CVSS v3 Score
7.0
High
CVSS v2 Score
6.0
Medium
Weakness Type
CWE-426
View all →

Vulnerability Description

A vulnerability was found in Mechrevo Control Console 1.0.2.70. It has been rated as critical. Affected by this issue is some unknown functionality in the library C:\Program Files\OEM\MECHREVO Control Center\UniwillService\MyControlCenter\csCAPI.dll of the component GCUService. The manipulation leads to uncontrolled search path. An attack has to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.

Related Vulnerabilities

CVE-2018-6218

HIGH
CVSS:7.0(High)

A DLL Hijacking vulnerability in Trend Micro's User-Mode Hooking Module (UMH) could allow an attacker to run arbitrary code on a vulnerable system.

CWE-4262018

CVE-2021-29221

HIGH
CVSS:7.0(High)

A local privilege escalation vulnerability was discovered in Erlang/OTP prior to version 23.2.3. By adding files to an existing installation's directory, a local attacker could hijack accounts of othe...

CWE-4262021

CVE-2022-26488

HIGH
CVSS:7.0(High)

In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. The installer may allow a local attacker to add user-writable directories to the sy...

CWE-4262022

CVE-2023-28143

HIGH
CVSS:7.0(High)

Qualys Cloud Agent for macOS (versions 2.5.1-75 before 3.7) installer allows a local escalation of privilege bounded only to the time of installation and only on older macOSX (macOS 10.15 and older) v...

CWE-4262023

CVE-2024-34123

HIGH
CVSS:7.0(High)

Premiere Pro versions 23.6.5, 24.4.1 and earlier are affected by an Untrusted Search Path vulnerability that could lead to arbitrary code execution. An attacker could exploit this vulnerability by ins...

CWE-4262024

CVE-2024-45207

HIGH
CVSS:7.0(High)

DLL injection in Veeam Agent for Windows can occur if the system's PATH variable includes insecure locations. When the agent runs, it searches these directories for necessary DLLs. If an attacker plac...

CWE-4262024