CVE-2017-5176 Other in Rockwell Automation Connected Components Workbench

High 7.0 Published 19 May 2017 Updated 5 Aug 2024

DLL hijacking in Rockwell CCW allows attackers to execute arbitrary code and escalate privileges to administrator level on the victim's computer.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2017-5176?

CVE-2017-5176 is a high-severity vulnerability in Rockwell Automation Connected Components Workbench, published on 19 May 2017. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

A DLL Hijack issue was discovered in Rockwell Automation Connected Components Workbench (CCW). The following versions are affected: Connected Components Workbench - Developer Edition, v9.01.00 and earlier: 9328-CCWDEVENE, 9328-CCWDEVZHE, 9328-CCWDEVFRE, 9328-CCWDEVITE, 9328-CCWDEVDEE, 9328-CCWDEVESE, and 9328-CCWDEVPTE; and Connected Components Workbench - Free Standard Edition (All Supported Languages), v9.01.00 and earlier. Certain DLLs included with versions of CCW software can be potentially hijacked to allow an attacker to gain rights to a victim's affected personal computer. Such access rights can be at the same or potentially higher level of privileges as the compromised user account, including and up to computer administrator privileges.

Weakness: CWE-427

Which versions are affected by CVE-2017-5176?

It affects 1 product.

Products include Rockwellautomation Connected Components Workbench.

How do I fix CVE-2017-5176?

No fix has been published for CVE-2017-5176 yet. Limit exposure of the affected software until one is available.

Is CVE-2017-5176 being exploited?

There is no known exploitation of CVE-2017-5176 in the wild and no public exploit code.

Sources

Also known as GHSA-cjwf-2ph9-3jpr.