CVE-2018-16156 - CVE House
Back to Database
Status published High CVE-2018-16156

In PaperStream IP (TWAIN) 1.42.0.5685 (Service Update 7), the FJTWSVIC...

Vulnerability Description

In PaperStream IP (TWAIN) 1.42.0.5685 (Service Update 7), the FJTWSVIC service running with SYSTEM privilege processes unauthenticated messages received over the FjtwMkic_Fjicube_32 named pipe. One of these message processing functions attempts to dynamically load the UninOldIS.dll library and executes an exported function named ChangeUninstallString. The default install does not contain this library and therefore if any DLL with that name exists in any directory listed in the PATH variable, it can be used to escalate to SYSTEM level privilege.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-16156

Credits & Attribution

No credits recorded in the NVD database.

References

More from fujitsu

View All →
CVE-2022-31795
An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 (Control...
Critical 9.8
CVE-2022-31794
An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 (Control...
Critical 9.8
CVE-2022-28806
An issue was discovered on certain Fujitsu LIEFBOOK devices (A3510,...
High 7.8
CVE-2022-27089
In Fujitsu PlugFree Network <= 7.3.0.3, an Unquoted service path...
High 7.8
CVE-2020-29127
An issue was discovered on Fujitsu Eternus Storage DX200 S4...
Critical 9.8

Affected Vendor

Affected Software

paperstream ip \(twain\)
Vulnerable Versions:
1.42.0.5685

Timeline

Official Publish: May 17th, 2019
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.