{"schemaVersion":3,"id":"CVE-2021-20793","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Untrusted search path vulnerability in the installer of Sony Audio USB Driver V1.10 and prior and the installer of HAP Music Transfer Ver.1.3.0 and prior allows an attacker to gain privileges and execute arbitrary code via a Trojan horse DLL in an unspecified directory.","dates":{"published":"2021-08-26T01:20:31.000Z","modified":"2024-08-03T17:53:22.532Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.8,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":4.4,"severity":"medium","vector":"AV:L/AC:M/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00315,"percentile":0.23082,"severity":"low","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-21T00:00:00.000Z","baselineScore":0.00315},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00315,"percentile":0.23082}],"last30":[{"date":"2026-09-21T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00315,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00315,"percentile":0.23082}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-427","name":"Uncontrolled Search Path Element","description":"The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/427.html"}],"affected":[{"vendor":"sony corporation","product":"the installers of multiple sony products","name":"The installers of multiple Sony products","label":"the installers of multiple sony products","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"The installer of Sony Audio USB Driver V1.10 and prior and The installer of HAP Music Transfer Ver.1.3.0 and prior","noFixRecorded":false,"fixedIn":null}],"versionsText":"The installer of Sony Audio USB Driver V1.10 and prior and The installer of HAP Music Transfer Ver.1.3.0 and prior","eol":null,"hubHref":"/vendor/sony_corporation/the_installers_of_multiple_sony_products"},{"vendor":"sony","product":"audio_usb_driver","name":"audio usb driver","label":"audio_usb_driver","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 1.10","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 1.10","eol":null,"hubHref":"/vendor/sony/audio_usb_driver"},{"vendor":"sony","product":"hap_music_transfer","name":"hap music transfer","label":"hap_music_transfer","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 1.3.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 1.3.0","eol":null,"hubHref":"/vendor/sony/hap_music_transfer"}],"affectedCount":3,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.sony.co.uk/electronics/support/software/00266749","label":"www.sony.co.uk/electronics/support/software/00266749","hostname":"www.sony.co.uk","tags":["X Refsource MISC","Product","Vendor Advisory"]},{"url":"https://www.sony.co.uk/electronics/support/software/00266758","label":"www.sony.co.uk/electronics/support/software/00266758","hostname":"www.sony.co.uk","tags":["X Refsource MISC","Product","Vendor Advisory"]},{"url":"https://www.sony.co.uk/electronics/support/software/00266642","label":"www.sony.co.uk/electronics/support/software/00266642","hostname":"www.sony.co.uk","tags":["X Refsource MISC","Product","Vendor Advisory"]},{"url":"https://jvn.jp/en/jp/JVN80288258/index.html","label":"jvn.jp/en/jp/JVN80288258/index.html","hostname":"jvn.jp","tags":["X Refsource MISC","Third Party Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2021-08-26T01:20:31.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-03T17:53:22.532Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":31,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T16:05:10.781Z","stale":false,"partial":false}}