FUJI ELECTRIC Pupsman DLL Search Path Pre-Auth RCE (CVE-2026-56437)

Vulnerability Overview Vulnerability ID: JVN#62347140 Vulnerability Name: Multiple vulnerabilities in Pupsman installer Description: - Uncontrolled Search Path Element (CVE-427): - CVSS 4.0: AV:L/AC:L/AT:N/PR:N/UI:R/V:C/H:I/VA:H/SC:N/SI:SA:N Base Score 8.4 - CVSS 3.0: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Base Score 7.8 - CVE-2026-56437 - An attacker can place a crafted DLL file in the folder containing the affected installer and execute the installer. - Incorrect Default Permissions (CVE-276): - CVSS 4.0: AV:L/AC:L/AT:N/PR:L/UE:N/VC:H/VI:VA:H/SC:N/SE:N/SA:N Base Score 8.5 - CVSS 3.0: AV:L/AC:L/PR:L/UE:N/S:U/C:H/I:H/A:H Base Score 7.8 - CVE-2026-57895 - An attacker can place a malicious executable in the installation folder, resulting in the execution of arbitrary code with SYSTEM privileges. Affected Products Affected Products: Pupsman versions prior to 3.9.0 Impact: - Arbitrary code execution with SYSTEM privileges may occur if a crafted DLL file is placed in the folder containing the affected installer and the installer is executed (CVE-2026-56437). - An attacker can place a malicious executable in the installation folder, resulting in the execution of arbitrary code with SYSTEM privileges (CVE-2026-57895). Remediation Solution: Update the software Steps: Use Pupsman version 3.9.0 or later, based on information provided by the developer. Additional Information Vendor Status: - Vendor: FUJI ELECTRIC CO., LTD. - Link: Pupsman (Text in Japanese) References: - Japanese Vulnerability Notes JVN#62347140 - Insecure DLL loading and command execution issues in many Windows applications Credits: - Reporter: Katsura Matsumoto from GMO Cybersecurity by HERAE, Inc. - Coordinator: JPCERT/CC coordinated with the developer under the Information Security Early Warning Partnership. Additional Links JPCERT Alert JPCERT Reports CERT Advisory CPNI Advisory TRoots CVE: - CVE-2026-56437 - CVE-2026-57895 JVN iPedia: JVNDB-2026-000095 Copyright Copyright © 2000-2026 JPCERT/CC and IPA. All rights reserved.

Goal Reached Thanks to every supporter — we hit 100%!

FUJI ELECTRIC Pupsman DLL Search Path Pre-Auth RCE (CVE-2026-56437)