DYMO ID CVE-2026-101893

Exploitation requires that the victim open DYMO ID's PC Job Files view and browse to a folder containing an attacker-supplied file with a recognized job-file extension - the view then parses EVERY such file automatically on folder browse, with no explicit open action. The attacker must therefore place the crafted file somewhere the victim will browse, typically a writable or attacker-controlled network share (SMB/UNC path). Limiting factors: this is a local attack vector requiring the victim to navigate to the hostile share (effective user interaction despite UI:N in the vector), impact is bounded (local file read, NTLMv2 hash capture, SSRF, or denial of service - not arbitrary code execution), and it affects DYMO ID 1.5.1.71 and earlier; upgrading to 1.6.0 remediates it.

This is a genuinely medium-severity, low-urgency issue rather than a critical priority. The authoritative CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N) scores 5.1 with only Low confidentiality and availability impact and no integrity impact, which matches the described capabilities (credential/hash capture, limited local file read, SSRF, and process crash) - none of which yield direct code execution. A notable internal tension exists: the vector encodes AV:L (local) and UI:N (no user interaction), yet the description states the victim must browse to a folder on a network share for the PC Job Files view to auto-parse the malicious file - so in practice some victim action (navigating to the attacker-controlled share) IS required, making UI:N optimistic. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided, so there are no exploitation-probability signals to weigh. Exploitation status: no public exploit identified at time of analysis. The strongest practical risk is NTLMv2 relay/cracking via the automatic outbound authentication that XXE/SSRF can coerce, which is a well-understood class of attack; however, the local attack vector, dependence on the victim browsing a hostile share, and limited technical impact keep real-world risk moderate. Prioritize patching but not as an emergency.

An attacker plants a crafted DYMO job file (with a malicious DTD/external entity) on a network share that a victim is likely to browse. When the victim opens the PC Job Files view and navigates to that folder, DYMO ID automatically parses the file via XmlDocument.Load(), causing the application to resolve an external entity that forces an outbound SMB/HTTP authentication - capturing the victim's NTLMv2 hash - or reads a local file, performs SSRF, or crashes. No public exploit code was identified, but the XXE-to-NTLM-capture technique is generic and trivially reproducible.