RSUPPORT RemoteView/RemoteCall Uncontrolled DLL Search Path Vulnerabilities (CVE-2025-26859/26860/26861)

Critical Vulnerability Information Vulnerability Overview Vulnerability ID: JVN#22713803 Description: Multiple RSUPPORT products may load dynamic link libraries insecurely. Affected Products CVE-2025-26859 - RemoteView PC Application Console versions prior to 6.0.2 CVE-2025-26860 - RemoteCall Remote Support Program (for Operator) versions prior to 5.1.0 CVE-2025-26861 - RemoteCall Remote Support Program (for Operator) versions prior to 5.3.0 Vulnerability Details RemoteView PC Application Console: - Vulnerability Type: Uncontrolled Search Path Element (CWE-427) - CVSS Score: 8.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:F/S:C) RemoteCall Remote Support Program (for Operator): - Vulnerability Type: Uncontrolled Search Path Element (CWE-427) - CVSS Score: 8.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:F/S:C) Impact If malicious DLLs are placed in the same directory as the affected products, arbitrary code execution may be possible. Remediation The vendor released fixed versions in 2017: - CVE-2025-26859: RemoteView PC Application Console 6.0.2 - CVE-2025-26860: RemoteCall Remote Support Program (for Operator) 5.1.0 - CVE-2025-26861: RemoteCall Remote Support Program (for Operator) 5.3.0 Users require no action; products will automatically upgrade to the latest version. Vendor Status RSUPPORT CO., LTD. has provided an end-of-service notice and download links. Additional Information These vulnerabilities were reported to IPA in 2017 and coordinated by JPCERT/CC with the vendor. The JVN was published in 2025.

Goal Reached Thanks to every supporter — we hit 100%!

RSUPPORT RemoteView/RemoteCall Uncontrolled DLL Search Path Vulnerabilities (CVE-2025-26859/26860/26861)