Read the docs
TI-2020-06321 Aliases CVE-2020-7807GHSA-x884-xw28-vpw4

DLL Hijacking Vulnerabilities During Installation of LG Electronics Software

Priority LOW 24CWE-353Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
Required
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

A vulnerability that can hijack a DLL file that is loaded during products(LGPCSuite_Setup, IPSFULLHD, LG_ULTRAWIDE, ULTRA_HD_Driver Setup) installation into a DLL file that the hacker wants. Missing Support for Integrity Check vulnerability in ____COMPONENT____ of LG Electronics (LGPCSuite_Setup), (IPSFULLHD, LG_ULTRAWIDE, ULTRA_HD_Driver Setup) allows ____ATTACKER/ATTACK____ to cause ____IMPACT____. This issue affects: LG Electronics; LGPCSuite_Setup : 1.0.0.3 on Windows(x86, x64); IPSFULLHD, LG_ULTRAWIDE, ULTRA_HD_Driver Setup : 1.0.0.9 on Windows(x86, x64).

Why it matters now

EPSS 0.00189 8th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
LG Electronics(LGPCSuite_Setup), (IPSFULLHD, LG_ULTRAWIDE, ULTRA_HD_Driver Setup)IPSFULLHD, LG_ULTRAWIDE, ULTRA_HD_Driver Setup.exe 1.0.0.3; LGPCSuite_Setup.exe 1.0.0.9—No fix listedCNA
  • (LGPCSuite_Setup), (IPSFULLHD, LG_ULTRAWIDE, ULTRA_HD_Driver Setup) VendorLG Electronics Affected IPSFULLHD, LG_ULTRAWIDE, ULTRA_HD_Driver Setup.exe 1.0.0.3; LGPCSuite_Setup.exe 1.0.0.9 Fixed in — No fix listed CNA

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:lg:ipsfullhd:1.0.0.3:*:*:*:*:*:*:*1.0.0.3VulnerableLG
cpe:2.3:a:lg:lg_ultrawide:1.0.0.3:*:*:*:*:*:*:*1.0.0.3VulnerableLG
cpe:2.3:a:lg:lgpcsuite_setup:1.0.0.9:*:*:*:*:*:*:*1.0.0.9VulnerableLG
cpe:2.3:a:lg:ultra_hd_driver_setup:1.0.0.3:*:*:*:*:*:*:*1.0.0.3VulnerableLG
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:a:lg:ipsfullhd:1.0.0.3:*:*:*:*:*:*:* Versions 1.0.0.3 Vulnerable ·LG
  • cpe:2.3:a:lg:lg_ultrawide:1.0.0.3:*:*:*:*:*:*:* Versions 1.0.0.3 Vulnerable ·LG
  • cpe:2.3:a:lg:lgpcsuite_setup:1.0.0.9:*:*:*:*:*:*:* Versions 1.0.0.9 Vulnerable ·LG
  • cpe:2.3:a:lg:ultra_hd_driver_setup:1.0.0.3:*:*:*:*:*:*:* Versions 1.0.0.3 Vulnerable ·LG
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-7807
  2. 2026-10-03 Alias added: GHSA-x884-xw28-vpw4

References

Advisory 2

  • TI-2024-02673 Path traversal via file upload on LG LED Assistant CVSS 3.1CRITICAL 9.8
  • TI-2024-02672 Password reset vulnerability without authorization on LG LED Assistant CVSS 3.1CRITICAL 9.8
  • TI-2023-04256 setThumbnailRC Directory Path Traversal Allows Unauthenticated Arbitrary File Read Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2023-04255 Upload Directory Path Traversal Allows Unauthenticated Arbitrary File Read Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2024-01754 Remote Code Execution attack on LG Signage CVSS 3.1CRITICAL 9.8
  • TI-2023-04258 thumbnail Directory Path Traversal Allows Unauthenticated Arbitrary File Read Vulnerability CVSS 3.1HIGH 7.5
See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences