CVE-2018-6765 - CVE House
Back to Database
Status published High CVE-2018-6765

Swisscom MySwisscomAssistant 2.17.1.1065 contains a vulnerability that could allow an...

Vulnerability Description

Swisscom MySwisscomAssistant 2.17.1.1065 contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on the targeted system. This vulnerability exists due to the way .dll files are loaded. It allows an attacker to load a .dll of the attacker's choosing that could execute arbitrary code without the user's knowledge. The specific flaw exists within the handling of several DLLs (dwmapi.dll, IPHLPAPI.DLL, WindowsCodecs.dll, RpcRtRemote.dll, CRYPTSP.dll, rasadhlp.dll, DNSAPI.dll, ntmarta.dll, netbios.dll, olepro32.dll, security.dll, winhttp.dll, WINSTA.dll) loaded by the MySwisscomAssistant_Setup.exe process.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-6765

Credits & Attribution

No credits recorded in the NVD database.

References

More from swisscom

View All →
CVE-2020-16134
An issue was discovered on Swisscom Internet Box 2, Internet...
High 8
CVE-2019-19942
Missing output sanitation in Swisscom Centro Grande Centro Grande before...
High 7.5
CVE-2019-19941
Missing hostname validation in Swisscom Centro Grande before 6.16.12 allows...
Medium 5.4
CVE-2019-19940
Incorrect input sanitation in text-oriented user interfaces (telnet, ssh) in...
High 7.2
CVE-2018-6766
Swisscom TVMediaHelper 1.1.0.50 contains a vulnerability that could allow an...
High 7.8

Affected Vendor

Affected Software

myswisscomassistant
Vulnerable Versions:
2.17.1.1065

Timeline

Official Publish: March 27th, 2018
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.