Incorrect default permissions in Portrait Display SDK
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA.
Summary
Applications developed using the Portrait Display SDK, versions 2.30 through 2.34, default to insecure configurations which allow arbitrary code execution. A number of applications developed using the Portrait Displays SDK do not use secure permissions when running. These applications run the component pdiservice.exe with NT AUTHORITY/SYSTEM permissions. This component is also read/writable by all Authenticated Users. This allows local authenticated attackers to run arbitrary code with SYSTEM privileges. The following applications have been identified by Portrait Displays as affected: Fujitsu DisplayView Click: Version 6.0 and 6.01. The issue was fixed in Version 6.3. Fujitsu DisplayView Click Suite: Version 5. The issue is addressed by patch in Version 5.9. HP Display Assistant: Version 2.1. The issue was fixed in Version 2.11. HP My Display: Version 2.0. The issue was fixed in Version 2.1. Philips Smart Control Premium: Versions 2.23, 2.25. The issue was fixed in Version 2.26.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Portrait Display | SDK | 2.30 and later | — | No fix listed | CNA |
- SDK VendorPortrait Display Affected 2.30 and later Fixed in — No fix listed CNA
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:portrait:portrait_display_sdk:*:*:*:*:*:*:*:* | 2.30 to before 2.34 | Vulnerable | Portrait |
| cpe:2.3:a:fujitsu:displayview_click:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Fujitsu |
| cpe:2.3:a:fujitsu:displayview_click:6.01:*:*:*:*:*:*:* | 6.01 | Vulnerable | Fujitsu |
| cpe:2.3:a:fujitsu:displayview_click_suite:5.0:*:*:*:*:*:*:* | 5.0 | Vulnerable | Fujitsu |
| cpe:2.3:a:hp:display_assistant:2.1:*:*:*:*:*:*:* | 2.1 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:a:hp:my_display:2.0:*:*:*:*:*:*:* | 2.0 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:a:philips:smart_control_premium:2.23:*:*:*:*:*:*:* | 2.23 | Vulnerable | Philips |
| cpe:2.3:a:philips:smart_control_premium:2.25:*:*:*:*:*:*:* | 2.25 | Vulnerable | Philips |
- cpe:2.3:a:portrait:portrait_display_sdk:*:*:*:*:*:*:*:* Versions 2.30 to before 2.34 Vulnerable ·Portrait
- cpe:2.3:a:fujitsu:displayview_click:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Fujitsu
- cpe:2.3:a:fujitsu:displayview_click:6.01:*:*:*:*:*:*:* Versions 6.01 Vulnerable ·Fujitsu
- cpe:2.3:a:fujitsu:displayview_click_suite:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Fujitsu
- cpe:2.3:a:hp:display_assistant:2.1:*:*:*:*:*:*:* Versions 2.1 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:a:hp:my_display:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:a:philips:smart_control_premium:2.23:*:*:*:*:*:*:* Versions 2.23 Vulnerable ·Philips
- cpe:2.3:a:philips:smart_control_premium:2.25:*:*:*:*:*:*:* Versions 2.25 Vulnerable ·Philips
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-3210
- 2026-10-03 Alias added: GHSA-xc6c-wx39-jcrf
References
Advisory 1
Sources
- CVE-2017-3210 · CVE Program
- CVE-2017-3210 · NVD
- FIRST EPSS
- GHSA-xc6c-wx39-jcrf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences