Untrusted search path vulnerability in Hanako 2017, Hanako 2016, Hanako 2015, Hanako Pro…
Priority LOW 36CWE-20Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA.
Summary
Untrusted search path vulnerability in Hanako 2017, Hanako 2016, Hanako 2015, Hanako Pro 3, JUST Office 3 [Standard], JUST Office 3 [Eco Print Package], JUST Office 3 & Tri-De DataProtect Package, JUST Government 3, JUST Jump Class 2, JUST Frontier 3, JUST School 6 Premium, Hanako Police 5, JUST Police 3, Hanako 2017 trial version allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
Why it matters now
EPSS 0.01173 67th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 15
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:justsystems:hanako:2015:*:*:*:*:*:*:* | 2015 | Vulnerable | Ichitaro 2023 |
| cpe:2.3:a:justsystems:hanako:2016:*:*:*:*:*:*:* | 2016 | Vulnerable | Ichitaro 2023 |
| cpe:2.3:a:justsystems:hanako:2017:*:*:*:*:*:*:* | 2017 | Vulnerable | Ichitaro 2023 |
| cpe:2.3:a:justsystems:hanako:2017:*:*:*:trial_version:*:*:* | 2017 | Vulnerable | Ichitaro 2023 |
| cpe:2.3:a:justsystems:hanako_police:5:*:*:*:*:*:*:* | 5 | Vulnerable | Ichitaro 2023 |
| cpe:2.3:a:justsystems:hanako_pro:3:*:*:*:*:*:*:* | 3 | Vulnerable | Ichitaro 2023 |
| cpe:2.3:a:justsystems:just_frontier:3:*:*:*:*:*:*:* | 3 | Vulnerable | Ichitaro 2023 |
| cpe:2.3:a:justsystems:just_government:3:*:*:*:*:*:*:* | 3 | Vulnerable | Ichitaro 2023 |
| cpe:2.3:a:justsystems:just_jump_class:2:*:*:*:*:*:*:* | 2 | Vulnerable | Ichitaro 2023 |
| cpe:2.3:a:justsystems:just_office:3:*:*:*:eco_print_pack:*:*:* | 3 | Vulnerable | Ichitaro 2023 |
- cpe:2.3:a:justsystems:hanako:2015:*:*:*:*:*:*:* Versions 2015 Vulnerable ·Ichitaro 2023
- cpe:2.3:a:justsystems:hanako:2016:*:*:*:*:*:*:* Versions 2016 Vulnerable ·Ichitaro 2023
- cpe:2.3:a:justsystems:hanako:2017:*:*:*:*:*:*:* Versions 2017 Vulnerable ·Ichitaro 2023
- cpe:2.3:a:justsystems:hanako:2017:*:*:*:trial_version:*:*:* Versions 2017 Vulnerable ·Ichitaro 2023
- cpe:2.3:a:justsystems:hanako_police:5:*:*:*:*:*:*:* Versions 5 Vulnerable ·Ichitaro 2023
- cpe:2.3:a:justsystems:hanako_pro:3:*:*:*:*:*:*:* Versions 3 Vulnerable ·Ichitaro 2023
- cpe:2.3:a:justsystems:just_frontier:3:*:*:*:*:*:*:* Versions 3 Vulnerable ·Ichitaro 2023
- cpe:2.3:a:justsystems:just_government:3:*:*:*:*:*:*:* Versions 3 Vulnerable ·Ichitaro 2023
- cpe:2.3:a:justsystems:just_jump_class:2:*:*:*:*:*:*:* Versions 2 Vulnerable ·Ichitaro 2023
- cpe:2.3:a:justsystems:just_office:3:*:*:*:eco_print_pack:*:*:* Versions 3 Vulnerable ·Ichitaro 2023
Show 5 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:justsystems:just_office:3:*:*:*:standard:*:*:* | 3 | Vulnerable | Ichitaro 2023 |
| cpe:2.3:a:justsystems:just_office:3:*:*:*:tri-de_dataprotect_pack:*:*:* | 3 | Vulnerable | Ichitaro 2023 |
| cpe:2.3:a:justsystems:just_police:3:*:*:*:*:*:*:* | 3 | Vulnerable | Ichitaro 2023 |
| cpe:2.3:a:justsystems:just_school:6:*:*:*:*:*:*:* | 6 | Vulnerable | Ichitaro 2023 |
| cpe:2.3:a:justsystems:just_school:6:*:*:*:premium:*:*:* | 6 | Vulnerable | Ichitaro 2023 |
- cpe:2.3:a:justsystems:just_office:3:*:*:*:standard:*:*:* Versions 3 Vulnerable ·Ichitaro 2023
- cpe:2.3:a:justsystems:just_office:3:*:*:*:tri-de_dataprotect_pack:*:*:* Versions 3 Vulnerable ·Ichitaro 2023
- cpe:2.3:a:justsystems:just_police:3:*:*:*:*:*:*:* Versions 3 Vulnerable ·Ichitaro 2023
- cpe:2.3:a:justsystems:just_school:6:*:*:*:*:*:*:* Versions 6 Vulnerable ·Ichitaro 2023
- cpe:2.3:a:justsystems:just_school:6:*:*:*:premium:*:*:* Versions 6 Vulnerable ·Ichitaro 2023
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-2154
- 2026-10-03 Alias added: GHSA-f2m3-hg92-v48c
References
More Ichitaro 2023 Hanako vulnerabilities
- TI-2013-00592 Unspecified vulnerability in JustSystems Ichitaro 2006 and 2007, Ichitaro Government 2006… CVSS 2.0HIGH 9.3
Sources
- CVE-2017-2154 · CVE Program
- CVE-2017-2154 · NVD
- FIRST EPSS
- GHSA-f2m3-hg92-v48c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences