QID 590728

Date Published: 2022-03-21

QID 590728: Eaton 9000x programing and configuration software DLL Hijacking Vulnerability (ETN-VA-2020-1007)

Eaton 9000x Programming and Configuration software v 2.0.38 and prior is susceptible to DLL hijacking vulnerability.
An attacker can execute arbitrary code by replacing the vci11un6. DLL and cinpl.DLL when application tries to load the DLLs to perform normal operations.

Affected Products:
9000x programing and configuration software 2.0.38 and prior versions

QID Detection Logic:(Authenticated)
The QID uses registry to check the vulnerable version of 9000XDrive.exe.

Successful exploitation of this vulnerability may lead to arbitrary code execution.

CVSS V3 rated as High - 7.8 severity.

CVSS V2 rated as Medium - 4.4 severity.

Solution

The vendor has released 9000x version 2.0.41 to remediate this vulnerability.

Vendor References

ETN-VA-2020-1007 - www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/9000x-software-eaton-vulnerability-advisory.pdf

CVEs related to QID 590728

CVE-2020-6654 |

Software Advisories

Advisory ID	Software	Component	Link
ETN-VA-2020-1007			www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/9000x-software-eaton-vulnerability-advisory.pdf

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].