CVE-2021-20722

Name of the Vulnerable Software and Affected Versions: ScanSnap Manager versions prior to V7.0L20 Software Download Installer versions prior to WinSSInst2JP.exe and WinSSInst2iX1500JP.exe

Description: The issue allows an attacker to gain privileges and execute arbitrary code with the privilege of the user invoking the installer via a Trojan horse DLL in an unspecified directory. This is due to an untrusted search path vulnerability in the installers.

Recommendations: For ScanSnap Manager versions prior to V7.0L20, update to version V7.0L20 or later to resolve the issue. For Software Download Installer versions prior to WinSSInst2JP.exe and WinSSInst2iX1500JP.exe, update to WinSSInst2JP.exe and WinSSInst2iX1500JP.exe or later to resolve the issue. As a temporary workaround, consider restricting access to the installer to minimize the risk of exploitation.