Yamaha Lan Monitor For Windows
Monthly
Arbitrary code execution in the Yamaha LAN Monitor for Windows installer versions up to and including Ver.1.9.3 stems from insecure DLL loading (CWE-427). A local attacker who can place a crafted DLL in the directory from which an administrator launches the installer can have that DLL loaded with the installer's administrative privileges, but the attack requires local write access and an administrator actually running the installer from that location. No CISA KEV entry or public exploit code was identified at time of analysis; the issue is local and depends on user interaction.
Arbitrary code execution in the Yamaha LAN Monitor for Windows installer versions up to and including Ver.1.9.3 stems from insecure DLL loading (CWE-427). A local attacker who can place a crafted DLL in the directory from which an administrator launches the installer can have that DLL loaded with the installer's administrative privileges, but the attack requires local write access and an administrator actually running the installer from that location. No CISA KEV entry or public exploit code was identified at time of analysis; the issue is local and depends on user interaction.