CVE-2017-5170 : What You Need to Know

A security issue, known as Uncontrolled Search Path Element, has been discovered in Moxa SoftNVR-IA Live Viewer, specifically in Version 3.30.3122 and earlier versions. This vulnerability involves an uncontrolled search path element, also referred to as DLL Hijacking. The vulnerability allows an attacker to potentially exploit the application by renaming a malicious Dynamic Link Library (DLL) to match the application's criteria. Moreover, the application does not verify the correctness of the DLL. In order to plant the insecure DLL, the attacker would need administrative access to the default installation location. Once the application loads the DLL, it could execute malicious code at the same privilege level as the application.

Understanding CVE-2017-5170

This section provides insights into the impact and technical details of CVE-2017-5170.

What is CVE-2017-5170?

CVE-2017-5170 is an Uncontrolled Search Path Element vulnerability found in Moxa SoftNVR-IA Live Viewer, allowing attackers to execute malicious code by manipulating DLL files.

The Impact of CVE-2017-5170

The vulnerability could lead to unauthorized execution of arbitrary code by an attacker with administrative access to the system, compromising the security and integrity of the application.

Technical Details of CVE-2017-5170

This section delves into the vulnerability description, affected systems, versions, and exploitation mechanism.

Vulnerability Description

The vulnerability in Moxa SoftNVR-IA Live Viewer Version 3.30.3122 and earlier versions stems from DLL Hijacking, enabling attackers to load malicious DLLs and execute arbitrary code.

Affected Systems and Versions

Product: Moxa SoftNVR-IA Live Viewer
Versions affected: Version 3.30.3122 and prior

Exploitation Mechanism

Attackers can exploit the vulnerability by renaming a malicious DLL to match the application's criteria without verification, requiring administrative access to the default installation location.

Mitigation and Prevention

In this section, we outline immediate steps and long-term security practices to mitigate the risks associated with CVE-2017-5170.

Immediate Steps to Take

Apply security patches provided by the vendor promptly to address the vulnerability.
Restrict access to critical system directories to prevent unauthorized DLL manipulation.

Long-Term Security Practices

Implement the principle of least privilege to limit administrative access and reduce the attack surface.
Regularly monitor and audit DLL loading activities to detect suspicious behavior.

Patching and Updates

Regularly update the Moxa SoftNVR-IA Live Viewer to the latest version to ensure that security patches are applied.