EUVD-2025-199943Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessPlant malicious DLL in installer directory
-
ExploitLure user to run INZONE Hub installer
-
ExecutionInsecure DLL search loads rogue library
-
ImpactArbitrary code executes as invoking user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V13 - Configuration Search path element control
|
| Exploitation Conditions | Exploitation requires the attacker to place a maliciously named DLL into a directory that the INZONE Hub installer (versions 1.0.10.3 through 1.0.17.0) searches before trusted system paths - in practice the same folder the installer is launched from, such as the user's Downloads directory. The victim must then actively execute that installer (UI:A), so this cannot be triggered remotely or automatically. Limiting factors: local access or a successful file-delivery vector to the target directory is needed, user must run the installer binary, exploitation yields only the privileges of the invoking user (no automatic elevation), and only the specific installer versions in range are affected. |
| Impact | This is a classic DLL search-path hijacking flaw (CWE-427) in the Sony INZONE Hub installer, and the signals converge on moderate, not urgent, risk. The only CVSS vector provided is CVSS 4.0 (8.4) and it is unambiguously local: AV:L (local attack vector) with UI:A (active user interaction required - the victim must run the installer), while PR:N indicates no prior authentication is needed. The high VC:H/VI:H/VA:H impact drives the 8.4 score, but the AV:L + UI:A combination means this is NOT remotely exploitable and requires a human to launch the vulnerable installer from an attacker-influenced directory. EPSS is very low (0.02%, 4th percentile), the CVE is NOT on CISA KEV, and no public exploit has been identified - all consistent with no observed exploitation. There is tension worth flagging: the 'RCE' tag and VI:H/VC:H impacts make this look severe, but the realistic risk is gated by the need for local file placement plus user-initiated execution of the installer, so the high base score overstates day-to-day exposure. This is a legitimate supply-chain/local-privilege-adjacent issue for affected endpoints but should be prioritized below network-exploitable or actively-exploited vulnerabilities. |
| Exploit ScenarioDerived | An attacker plants a malicious DLL (matching a name the installer searches for insecurely) into a directory the INZONE Hub installer will search first - typically the user's Downloads folder alongside the downloaded installer. When the victim double-clicks the installer, the rogue DLL is loaded and arbitrary code runs with that user's privileges. No public exploit code is identified, but DLL search-order hijacking is a well-understood, low-effort technique. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 18, 2026
Arbitrary code execution with the invoking user's privileges is possible through a DLL search-path hijacking flaw (CWE-427) in Sony's INZONE Hub installer versions 1.0.10.3 through 1.0.17.0. Because the installer resolves library names relative to the directory it is launched from - typically the Downloads folder - an attacker who can drop a correctly named DLL alongside the installer can have it loaded when the victim runs the setup binary; the CVSS vectors carry PR:N (unauthenticated) but UI:R/UI:A, meaning the victim must actively execute the installer, and the resulting code runs only at the user's existing privilege level, not elevated. Reported through JVN by JPCERT/CC, the issue has a very low EPSS score (0.02%, 4th percentile), no public exploit code identified at time of analysis, and no CISA KEV listing, so the realistic risk is moderate and tied to social-engineering or local file-placement scenarios rather than broad remote attack.
Earlier versions of this analysis (1)
The installer of INZONE Hub 1.0.10.3 to 1.0.17.0 contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed wi
RemediationAI
Replace the affected installer: obtain the current INZONE Hub package directly from Sony's support page (https://www.sony.com/electronics/support/others-software/inzone-hub) as directed by JVN advisory JVN28247549 (https://jvn.jp/en/jp/JVN28247549/); the available data does not specify an exact patched version number, so confirm the build is newer than 1.0.17.0 before deployment. Until upgraded, treat the installer as untrusted input: never launch it from a user-writable staging location such as Downloads, Desktop or a temp folder - copy it into a directory only the executing user (or an administrator) can write to, and run it from there, which removes the writable directory the loader would search first; the trade-off is operational friction for help-desk and software-deployment workflows. Additionally, verify the installer's hash or signature against Sony's published values before execution, and scan the containing folder for unexpected DLL files (side effect: signature enforcement may block repackaged enterprise installers). Because the flaw requires the victim to run the binary, restricting end users from executing downloaded installers outside managed deployment tooling removes the delivery path at the cost of some flexibility. Detection should focus on DLL files appearing alongside the INZONE Hub installer and on the installer process loading libraries from user-writable paths.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-427, Uncontrolled Search Path Element. Windows library loading resolves DLL names against an ordered set of directories, and the application directory or current working directory is searched ahead of trusted system paths. When an installer package (here, the INZONE Hub setup program that configures Sony's headset software) is run without fully qualified or safely resolved library paths, any DLL with a matching name present in the folder the executable is started from will be loaded and its DllMain executed in-process. The attack model therefore mirrors classic binary-planting: deliver a malicious DLL into the same directory as the installer, persuade the user to run the installer, and gain code execution as that user. The CVSS:4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H) and the independent CVSS:3.1 assessment (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) both describe local attack vector, no privileges required, mandatory user interaction, and high confidentiality, integrity and availability impact confined to the victim's own security scope (no scope change), reflecting that there is no automatic elevation. No CPE strings were supplied in the available data; affected coverage is defined by the EUVD/JVN version range 1.0.10.3 to 1.0.17.0.
Know when Sony gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Local DLL hijack needs no prior auth (PR:N) but requires the user to run the installer (UI:R) and a planted file, with full code execution giving C/I/A:H.
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
Lifecycle Timeline
3DescriptionCVE.org
The installer of INZONE Hub 1.0.10.3 to 1.0.17.0 contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with the privilege of the user invoking the installer.
Executive ViewAI
Sony INZONE Hub installer versions 1.0.10.3 through 1.0.17.0 can be made to load a malicious DLL placed alongside the setup file, allowing code execution at the victim user’s privilege level when that user runs the installer. Leadership should care because exploitation requires user action and is concentrated in software-distribution and endpoint user behavior rather than broad remote compromise; no public exploit identified at time of analysis and no vendor-released patch identified at time of analysis.
No vendor-released patch identified at time of analysis; interim mitigations include running the installer only from a trusted, non-user-writable location after hash verification, blocking execution from Downloads, enforcing application control/allowlisting, removing unnecessary INZONE Hub installations, and monitoring for side-by-side DLL placement and unusual child processes from setup binaries.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Multiple buffer overflows in the Wireless Manager ActiveX control 4.0.0.0 in WifiMan.dll in Sony VAIO PC Wireless LAN Wi
SONY SNC-CH115, SNC-CH120, SNC-CH160, SNC-CH220, SNC-CH260, SNC-DH120, SNC-DH120T, SNC-DH160, SNC-DH220, SNC-DH220T, SNC
The Sony Bravia TV KDL-32CX525 allows remote attackers to cause a denial of service (configuration outage or device cras
Sony BRAVIA Digital Signage 1.7.8 has an IDOR vulnerability that allows attackers to access hidden system resources like
In Sony Xperia series 1, 5, and Pro, an out of bound memory access can occur due to lack of validation of the number of
Sony Bravia Smart TV devices allow remote attackers to retrieve the static Wi-Fi password (used when the TV is acting as
A weak malicious user can escalate its privilege whenever CatalystProductionSuite.2019.1.exe (version 1.1.0.21) and Cata
Bravia Signage contains a vulnerability that allows attackers to access sensitive system details through API endpoints (
An exploitable command injection vulnerability exists in the measurementBitrateExec functionality of Sony IPELA E Series
Cross-site request forgery (CSRF) vulnerability in the command/user.cgi in Sony SNC CH140, SNC CH180, SNC CH240, SNC CH2
Sony XAV-AX5500 Insufficient Firmware Update Validation Remote Code Execution Vulnerability. Rated medium severity (CVSS
A vulnerability was found in Sony PS4 and PS5. Rated medium severity (CVSS 6.8), this vulnerability is no authentication
GitHub PoC
Exploit-DB