CVE-2021-1240: 
Homebrew vulnerability analysis and mitigation

CVE-2021-1240 is a DLL hijacking vulnerability discovered in Cisco Proximity Desktop for Windows, disclosed on January 13, 2021. The vulnerability affects Cisco Proximity Desktop for Windows releases earlier than Release 3.1.0, allowing an authenticated local attacker to load a malicious library due to incorrect handling of directory paths at runtime (Cisco Advisory).

The vulnerability stems from incorrect handling of directory paths at runtime in the DLL loading process. It has been assigned a CVSS Base Score of 4.8 (Medium) with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:X/RL:X/RC:X. The vulnerability is classified under CWE-427 (Cisco Advisory).

A successful exploitation could allow an attacker to execute arbitrary code on the targeted system with the privileges of another user's account. The attacker must have valid credentials on the Windows system to exploit this vulnerability (Cisco Advisory).

To exploit this vulnerability, an attacker must have valid credentials on the Windows system and place a malicious DLL file in a specific location on the targeted system. The file will execute when the vulnerable application launches. The Cisco PSIRT was not aware of any public announcements or malicious use of the vulnerability at the time of disclosure (Cisco Advisory).

Cisco has released software updates that address this vulnerability in Cisco Proximity Desktop for Windows Release 3.1.0 and later versions. No workarounds are available for this vulnerability. Users are advised to upgrade to a fixed version (Cisco Advisory).

The vulnerability was reported by Xavier Danest of Decathlon, demonstrating active security research engagement from the private sector (Cisco Advisory).