{"id":"CVE-2024-25103","state":"PUBLISHED","title":"Dynamic Link Library (DLL) Hijacking Vulnerability in CDAC AppSamvid Software","description":"This vulnerability exists in AppSamvid software due to the usage of vulnerable and outdated components. An attacker with local administrative privileges could exploit this by placing malicious DLLs on the targeted system.\n\nSuccessful exploitation of this vulnerability could allow the attacker to execute arbitrary code on the targeted system.","publishedAt":"2024-03-06T11:42:58.575Z","updatedAt":"2024-09-23T11:19:05.925Z","severity":{"score":6.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H","source":"CERT-In"},"assigner":"CERT-In","products":["CDAC AppSamvid Software"],"affected":[{"vendor":"CDAC","product":"AppSamvid Software","defaultStatus":"unaffected","versions":[{"version":"<=2.0.1","status":"affected"}]}],"references":["https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0081"],"weaknesses":["CWE-426"],"ingestedAt":"2026-10-29T20:07:10.607Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/25xxx/CVE-2024-25103.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-25103","state":"PUBLISHED","datePublished":"2024-03-06T11:42:58.575Z","dateUpdated":"2024-09-23T11:19:05.925Z","assignerShortName":"CERT-In","assignerOrgId":"66834db9-ab24-42b4-be80-296b2e40335c","dateReserved":"2024-02-05T07:50:59.669Z"},"containers":{"cna":{"title":"Dynamic Link Library (DLL) Hijacking Vulnerability in CDAC AppSamvid Software","descriptions":[{"lang":"en","value":"This vulnerability exists in AppSamvid software due to the usage of vulnerable and outdated components. An attacker with local administrative privileges could exploit this by placing malicious DLLs on the targeted system.\n\nSuccessful exploitation of this vulnerability could allow the attacker to execute arbitrary code on the targeted system."}],"affected":[{"vendor":"CDAC","product":"AppSamvid Software","defaultStatus":"unaffected","versions":[{"version":"<=2.0.1","status":"affected"}]}],"references":[{"url":"https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0081"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-426","description":"CWE-426 Untrusted Search Path","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"CERT-In","orgId":"66834db9-ab24-42b4-be80-296b2e40335c","dateUpdated":"2024-09-23T11:19:05.925Z"},"credits":[{"lang":"en","type":"finder","value":"This vulnerability is reported by Mukund Kedia and Avinash Kumar."}],"impacts":[{"capecId":"CAPEC-38","descriptions":[{"lang":"en","value":"CAPEC-38 Leveraging/Manipulating Configuration File Search Paths"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Upgrade to AppSamvid version 2.0.2 or later.<br><br><a target=\"_blank\" rel=\"nofollow\" href=\"https://cdac.in/index.aspx?id=cs_eps_appsamvid\">https://cdac.in/index.aspx?id=cs_eps_appsamvid</a><br>"}],"value":"Upgrade to AppSamvid version 2.0.2 or later.\n\n https://cdac.in/index.aspx?id=cs_eps_appsamvid"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0081","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T23:36:21.613Z"}},{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"cdac","product":"appsamvid_software","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.0.1","versionType":"custom"}],"cpes":["cpe:2.3:a:cdac:appsamvid_software:*:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-03-06T16:51:32.411086Z","id":"CVE-2024-25103","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-08-29T13:31:27.346Z"}}]}}}