Untrusted search path in Japan Agency for Local Authority Information Systems Installer…
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-426.
Summary
Untrusted search path vulnerability in installers for The Public Certification Service for Individuals "The JPKI user's software (for Windows 7 and later)" Ver3.1 and earlier, The Public Certification Service for Individuals "The JPKI user's software (for Windows Vista)", The Public Certification Service for Individuals "The JPKI user's software" Ver2.6 and earlier that were available until April 27, 2017 allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Japan Agency for Local Authority Information Systems | Installer for The Public Certification Service for Individuals "The JPKI user's software (for Windows 7 and later)" | Ver3.1 and earlier that was available until April 27, 2017 | — | No fix listed | CNA |
| Japan Agency for Local Authority Information Systems | Installer for The Public Certification Service for Individuals "The JPKI user's software (for Windows Vista)" | available until April 27, 2017 | — | No fix listed | CNA |
| Japan Agency for Local Authority Information Systems | Installer for The Public Certification Service for Individuals "The JPKI user's software" | Ver2.6 and earlier that was available until April 27, 2017 | — | No fix listed | CNA |
- Installer for The Public Certification Service for Individuals "The JPKI user's software (for Windows 7 and later)" VendorJapan Agency for Local Authority Information Systems Affected Ver3.1 and earlier that was available until April 27, 2017 Fixed in — No fix listed CNA
- Installer for The Public Certification Service for Individuals "The JPKI user's software (for Windows Vista)" VendorJapan Agency for Local Authority Information Systems Affected available until April 27, 2017 Fixed in — No fix listed CNA
- Installer for The Public Certification Service for Individuals "The JPKI user's software" VendorJapan Agency for Local Authority Information Systems Affected Ver2.6 and earlier that was available until April 27, 2017 Fixed in — No fix listed CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:jpki:the_public_certification_service_for_individuals:*:*:*:*:*:*:*:* | up to 2.6 | Vulnerable | Jpki |
| cpe:2.3:a:jpki:the_public_certification_service_for_individuals:*:*:*:*:windows_7:*:*:* | up to 3.1 | Vulnerable | Jpki |
| cpe:2.3:a:jpki:the_public_certification_service_for_individuals:-:*:*:*:windows_vista:*:*:* | not specified by NVD | Vulnerable | Jpki |
- cpe:2.3:a:jpki:the_public_certification_service_for_individuals:*:*:*:*:*:*:*:* Versions up to 2.6 Vulnerable ·Jpki
- cpe:2.3:a:jpki:the_public_certification_service_for_individuals:*:*:*:*:windows_7:*:*:* Versions up to 3.1 Vulnerable ·Jpki
- cpe:2.3:a:jpki:the_public_certification_service_for_individuals:-:*:*:*:windows_vista:*:*:* Versions not specified by NVD Vulnerable ·Jpki
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-2157
- 2026-10-03 Alias added: GHSA-x8rm-c2pf-m49v
References
Advisory 1
More Jpki The Public Certification Service For Individuals vulnerabilities
- TI-2016-04245 Untrusted search path in Japan Agency for Local Authority Information Systems The Public… CVSS 3.0HIGH 7.8
Sources
- CVE-2017-2157 · CVE Program
- CVE-2017-2157 · NVD
- FIRST EPSS
- GHSA-x8rm-c2pf-m49v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences