Untrusted search path in SAP Plant Connectivity
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-426.
Summary
A malicious DLL preload attack possible on NwSapSetup and Installation self-extracting program for SAP Plant Connectivity 2.3 and 15.0. It is possible that SAPSetup / NwSapSetup.exe loads system DLLs like DWMAPI.dll (located in your Syswow64 / System32 folder) from the folder the executable is in and not from the system location. The desired behavior is that system dlls are only loaded from the system folders. If a dll with the same name as the system dll is located in the same folder as the executable, this dll is loaded and code is executed.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SAP | SAP Plant Connectivity | 2.3; 15.0 | — | No fix listed | CNA |
- SAP Plant Connectivity VendorSAP Affected 2.3; 15.0 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-16690
- 2026-10-03 Alias added: GHSA-wvmg-58g2-r2x7
References
More SAP Plant Connectivity vulnerabilities
- TI-2015-06857 The PCo agent in SAP Plant Connectivity (PCo) allows remote attackers to cause a denial… CVSS 2.0HIGH 7.8
- TI-2023-02648 Missing Authentication in SAP Plant Connectivity and Production Connector for SAP Digital CVSS 3.1HIGH 7.9
Sources
- CVE-2017-16690 · CVE Program
- CVE-2017-16690 · NVD
- FIRST EPSS
- GHSA-wvmg-58g2-r2x7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences