CVE-2026-34488

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34488", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2026-04-10T08:17:32.779Z", "datePublished": "2026-04-23T06:17:13.836Z", "dateUpdated": "2026-04-23T12:25:09.286Z"}, "containers": {"cna": {"affected": [{"vendor": "i-PRO Co., Ltd.", "product": "IP Setting Software", "versions": [{"version": "prior to V5.20", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "IP Setting Software contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with administrative privileges."}], "problemTypes": [{"descriptions": [{"description": "Uncontrolled Search Path Element", "lang": "en-US", "cweId": "CWE-427", "type": "CWE"}]}], "references": [{"url": "https://i-pro.com/products_and_solutions/en/surveillance/solutions/technologies/cyber-security/psirt/security-advisories"}, {"url": "https://jvn.jp/en/jp/JVN42090270/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_0": {"version": "3.0", "baseSeverity": "HIGH", "baseScore": 7.3, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"}}, {"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV4_0": {"version": "4.0", "baseSeverity": "HIGH", "baseScore": 7, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2026-04-23T06:17:13.836Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-23T12:25:00.681337Z", "id": "CVE-2026-34488", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-23T12:25:09.286Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34488", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-23T12:25:00.681337Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-23T12:25:04.435Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "i-PRO Co., Ltd.", "product": "IP Setting Software", "versions": [{"status": "affected", "version": "prior to V5.20"}]}], "references": [{"url": "https://i-pro.com/products_and_solutions/en/surveillance/solutions/technologies/cyber-security/psirt/security-advisories"}, {"url": "https://jvn.jp/en/jp/JVN42090270/"}], "descriptions": [{"lang": "en", "value": "IP Setting Software contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with administrative privileges."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-427", "description": "Uncontrolled Search Path Element"}]}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2026-04-23T06:17:13.836Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34488", "state": "PUBLISHED", "dateUpdated": "2026-04-23T12:25:09.286Z", "dateReserved": "2026-04-10T08:17:32.779Z", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "datePublished": "2026-04-23T06:17:13.836Z", "assignerShortName": "jpcert"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "IP Setting Software", "vendor": "i-PRO Co., Ltd.", "versions": [{"status": "affected", "version": "prior to V5.20"}]}], "source": "vultures@jpcert.or.jp"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IP Setting Software contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with administrative privileges."}, {"lang": "es", "value": "El Software de configuraci\u00f3n IP contiene un problema con la ruta de b\u00fasqueda de DLL, lo que puede llevar a la carga insegura de Bibliotecas de Enlace Din\u00e1mico. Como resultado, se puede ejecutar c\u00f3digo arbitrario con privilegios administrativos."}], "id": "CVE-2026-34488", "lastModified": "2026-10-26T00:10:00.150", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.3, "impactScore": 5.9, "source": "vultures@jpcert.or.jp", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "vultures@jpcert.or.jp", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34488", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-23T12:25:00.681337Z", "version": "2.0.3"}}]}, "published": "2026-04-23T07:16:40.813", "references": [{"source": "vultures@jpcert.or.jp", "url": "https://i-pro.com/products_and_solutions/en/surveillance/solutions/technologies/cyber-security/psirt/security-advisories"}, {"source": "vultures@jpcert.or.jp", "url": "https://jvn.jp/en/jp/JVN42090270/"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-427"}], "source": "vultures@jpcert.or.jp", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,5.20)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "IP Setting Software", "source": "cna", "vendor": "i-PRO Co., Ltd."}, "product": "ip_setting_software", "vendor": "i-pro"}], "analysis": {"en": {"generated_at": "2026-04-28T20:34:33.355523+00:00", "value": {"mitigation_remediation": ["Obtain and install the vendor\u2019s latest security update for IP Setting Software.", "Restrict write permissions on directories referenced by the software\u2019s DLL search path so that only trusted accounts can place files there.", "Configure the application or operating system to use a secure DLL search path that limits library loading to approved system directories."], "summary": {"action": "Immediate Patch", "impact": "Arbitrary Code Execution with Administrative Privileges"}, "threat_synthesis": {"affected_systems": "The vulnerability affects i\u2011PRO Co., Ltd.\u2019s IP Setting Software. No specific version numbers are provided, so all installations of this product are considered potentially susceptible.", "description_and_impact": "i\u2011PRO IP Setting Software contains an uncontrolled DLL search path that allows an attacker to load an unauthorized Dynamic Link Library. Once the malicious DLL is loaded, code can be executed with the software\u2019s administrative privileges, leading to full system compromise. The flaw is classified as CWE\u2011427, representing an untrusted path used to load executable code.", "risk_and_exploitability": "The CVSS score of 7 indicates a high severity, yet the EPSS indicator of less than 1% suggests a low probability of current exploitation. The flaw is not listed in CISA\u2019s KEV catalog. Likely attack vectors involve a local user with the ability to place a crafted DLL in a directory that appears in the software\u2019s search path, or via an existing privileged process that can influence DLL loading. Because the weakness requires administrative rights to execute arbitrary code, the potential impact is broad compromise of the affected system."}}}}, "created": "2026-04-28T09:26:18.847038+00:00", "title": "DLL Search Path Vulnerability in i\u2011PRO IP Setting Software Allows Arbitrary Code Execution with Administrative Privileges", "updated": "2026-04-28T20:45:16.587203+00:00", "vendors": ["i-pro", "i-pro$PRODUCT$ip_setting_software"]}