CVE-2018-10655

Vulnerability

The vulnerability is a Unicode buffer overflow in DLPnpAuditor.exe, part of DeviceLock Plug and Play Auditor freeware version 5.72. When using the "scan network from file" option with a specially crafted text file, a buffer overflow occurs. The payload is converted to Unicode (null bytes inserted), requiring an address compatible with Unicode (with null bytes) for exploitation [1].

Exploitation

An attacker needs to provide a malicious text file to the victim, who must open it via the "scan network from file" option in DLPnpAuditor.exe. No authentication is required beyond the victim running the application. The exploit overwrites the SEH chain, as demonstrated in the advisory [1].

Impact

Successful exploitation leads to arbitrary code execution in the context of the application. The attacker gains control of the program's execution flow, potentially allowing system compromise dependent on the privileges of the user running the software [1].

Mitigation

No official patch or updated version has been released as of the advisory date (May 2018). DeviceLock Plug and Play Auditor is freeware; the vendor may not provide updates. Users should avoid opening untrusted text files with this software. Not listed on KEV [1].