Untrusted search path in Japan Agency for Local Authority Information Systems The Public…
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-426.
Summary
Untrusted search path vulnerability in The Public Certification Service for Individuals "The JPKI user's software (for Windows 7 and later)" Ver3.0.1 and earlier, The Public Certification Service for Individuals "The JPKI user's software (for Windows Vista)" Ver3.0.1 and earlier and The Public Certification Service for Individuals "The JPKI user's software" Ver2.6 and earlier allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Japan Agency for Local Authority Information Systems | The Public Certification Service for Individuals "The JPKI user's software (for Windows 7 and later)" | Ver3.0.1 and earlier | — | No fix listed | CNA |
| Japan Agency for Local Authority Information Systems | The Public Certification Service for Individuals "The JPKI user's software (for Windows Vista)" | Ver3.0.1 and earlier | — | No fix listed | CNA |
| Japan Agency for Local Authority Information Systems | The Public Certification Service for Individuals "The JPKI user's software" | Ver2.6 and earlier | — | No fix listed | CNA |
- The Public Certification Service for Individuals "The JPKI user's software (for Windows 7 and later)" VendorJapan Agency for Local Authority Information Systems Affected Ver3.0.1 and earlier Fixed in — No fix listed CNA
- The Public Certification Service for Individuals "The JPKI user's software (for Windows Vista)" VendorJapan Agency for Local Authority Information Systems Affected Ver3.0.1 and earlier Fixed in — No fix listed CNA
- The Public Certification Service for Individuals "The JPKI user's software" VendorJapan Agency for Local Authority Information Systems Affected Ver2.6 and earlier Fixed in — No fix listed CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:jpki:the_public_certification_service_for_individuals:*:*:*:*:*:*:*:* | up to 2.6 | Vulnerable | Jpki |
| cpe:2.3:a:jpki:the_public_certification_service_for_individuals_for_windows_7:*:*:*:*:*:*:*:* | up to 3.0.1 | Vulnerable | Jpki |
| cpe:2.3:a:jpki:the_public_certification_service_for_individuals_for_windows_vista:*:*:*:*:*:*:*:* | up to 3.0.1 | Vulnerable | Jpki |
- cpe:2.3:a:jpki:the_public_certification_service_for_individuals:*:*:*:*:*:*:*:* Versions up to 2.6 Vulnerable ·Jpki
- cpe:2.3:a:jpki:the_public_certification_service_for_individuals_for_windows_7:*:*:*:*:*:*:*:* Versions up to 3.0.1 Vulnerable ·Jpki
- cpe:2.3:a:jpki:the_public_certification_service_for_individuals_for_windows_vista:*:*:*:*:*:*:*:* Versions up to 3.0.1 Vulnerable ·Jpki
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2016-4902
- 2026-10-03 Alias added: GHSA-6qq2-69c3-wr79
References
Advisory 1
More Jpki The Public Certification Service For Individuals vulnerabilities
- TI-2017-01460 Untrusted search path in Japan Agency for Local Authority Information Systems Installer… CVSS 3.0HIGH 7.3
Sources
- CVE-2016-4902 · CVE Program
- CVE-2016-4902 · NVD
- FIRST EPSS
- GHSA-6qq2-69c3-wr79 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences