{"id":"CVE-2024-37127","state":"PUBLISHED","title":"Dell Peripheral Manager, versions prior to 1.7.6, contain an uncontrolled search path element vulnerability. An attacker could potentially exploit this vulnerability through preloa","description":"Dell Peripheral Manager, versions prior to 1.7.6, contain an uncontrolled search path element vulnerability. An attacker could potentially exploit this vulnerability through preloading malicious DLL or symbolic link exploitation, leading to arbitrary code execution and escalation of privilege","publishedAt":"2024-07-31T08:25:10.346Z","updatedAt":"2024-07-31T13:53:39.735Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"dell"},"assigner":"dell","products":["Dell Dell Peripheral Manager"],"affected":[{"vendor":"Dell","product":"Dell Peripheral Manager","defaultStatus":"unaffected","versions":[{"version":"N/A","status":"affected","lessThan":"1.7.6","versionType":"semver"}]}],"references":["https://www.dell.com/support/kbdoc/en-us/000225474/dsa-2024-242"],"weaknesses":["CWE-427"],"ingestedAt":"2026-10-29T20:07:30.303Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/37xxx/CVE-2024-37127.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-37127","state":"PUBLISHED","datePublished":"2024-07-31T08:25:10.346Z","dateUpdated":"2024-07-31T13:53:39.735Z","assignerShortName":"dell","assignerOrgId":"c550e75a-17ff-4988-97f0-544cde3820fe","dateReserved":"2024-06-03T12:08:48.716Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Dell Peripheral Manager, versions prior to 1.7.6, contain an uncontrolled search path element vulnerability. An attacker could potentially exploit this vulnerability through preloading malicious DLL or symbolic link exploitation, leading to arbitrary code execution and escalation of privilege"}],"affected":[{"vendor":"Dell","product":"Dell Peripheral Manager","defaultStatus":"unaffected","versions":[{"version":"N/A","status":"affected","lessThan":"1.7.6","versionType":"semver"}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000225474/dsa-2024-242","tags":["vendor-advisory"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-427","description":"CWE-427: Uncontrolled Search Path Element","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"dell","orgId":"c550e75a-17ff-4988-97f0-544cde3820fe","dateUpdated":"2024-07-31T08:25:10.346Z"},"credits":[{"lang":"en","type":"finder","value":"Dell Technologies would like to thank Ouallaout Noureddine for reporting these issues"}],"datePublic":"2024-07-30T06:30:00.000Z","source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"dell","product":"peripheral_manager","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"1.7.6","versionType":"semver"}],"cpes":["cpe:2.3:a:dell:peripheral_manager:*:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-07-31T13:16:05.335851Z","id":"CVE-2024-37127","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-07-31T13:53:39.735Z"}}]}}}