An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM. Alternatively, they could host a trojanized version of the software and trick victims into downloading and installing their malicious version to gain initial access and code execution.
The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
| Link | Tags |
|---|---|
| https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-03 | government resource third party advisory us government resource |
| https://www.ptc.com/en/support/article/cs399528 | vendor advisory |