← Vulnerability feed

Vulnerability record · CVE-2017-14017 · published 19 October 2017

CVE-2017-14017: Progea movicon uncontrolled search path element vulnerability

Progea · Movicon

An Uncontrolled Search Path Element issue was discovered in Progea Movicon Version 11.5.1181 and prior. An uncontrolled search path element vulnerability has been identified, which may allow a remote attacker without privileges to execute arbitrary code in the form of a malicious DLL file.

7.8 CVSS 3.0 High EPSS 0.70% · top 48.8% CWE-427 · Uncontrolled search path element
7.8CVSS 3.0 base score, v2 4.6
0.70%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

An Uncontrolled Search Path Element issue was discovered in Progea Movicon Version 11.5.1181 and prior. An uncontrolled search path element vulnerability has been identified, which may allow a remote attacker without privileges to execute arbitrary code in the form of a malicious DLL file.

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.securityfocus.com/bid/101483 Third Party AdvisoryVDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-17-290-01 Third Party AdvisoryUS Government Resource
http://www.securityfocus.com/bid/101483 Third Party AdvisoryVDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-17-290-01 Third Party AdvisoryUS Government Resource

Track CVE-2017-14017 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2011-2963Progea movicon improper authentication vulnerabilityTCPUploadServer.exe in Progea Movicon 11.2 before Build 1084 does not require authentication for critical functions, which allows remote attackers to…EPSS 7.6%7.8CVE-2012-1804Progea movicon memory buffer overflow vulnerabilityThe OPC server in Progea Movicon before 11.3 allows remote attackers to cause a denial of service (out-of-bounds read and memory corruption) via a cr…EPSS 2.8%6.7CVE-2017-14019Progea movicon unquoted search path vulnerabilityAn Unquoted Search Path or Element issue was discovered in Progea Movicon Version 11.5.1181 and prior. An unquoted search path or element vulnerabili…EPSS 0.41%4.3CVE-2014-0778Progea movicon information exposure vulnerabilityTCPUploader module listens on Port 10651/TCP for incoming connections. Exploitation of this vulnerability could allow a remote unauthenticated user a…EPSS 1.3%7.8CVE-2020-3433Cisco AnyConnect Windows client DLL hijacking via IPC channelCisco AnyConnect Secure Mobility Client for Windows fails to properly validate resources loaded at run time, allowing a DLL hijacking attack through …KEVEPSS 10%analysed6.5CVE-2020-3153Cisco AnyConnect Windows Installer Path Handling Privilege EscalationThe Cisco AnyConnect Secure Mobility Client for Windows installer mishandles directory paths, letting an authenticated local user copy attacker-suppl…KEVEPSS 28%analysed

Source: NIST National Vulnerability Database (record CVE-2017-14017), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.