Summary
Newell Brands DYMO ID contains two vulnerabilities that could capture NTLMv2 credentials or code execution at a victim's privilege level after clicking on a crafted job file.
Vulnerabilities 2
-
High 7.3CVE-2026-102262 Public exploit
Newell Brands DYMO ID parent directory open to path traversal through improper spheres of control
Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to the process working directory. An attacker could store a job file alongside malicious modules / DLL that sets the process working directory to the job file's folder when a victim…
-
Medium 4.4
Newell Brands DYMO ID document parsing failing file type extension authentication check
Newell Brands DYMO ID 1.5.1.71 parses job files using XmlDocument.Load() without disabling DTD processing. The PC Job Files view automatically parses every recognized job file extension on folder browse. A crafted file on any browsed network share can perform…
Revision history
-
#1.0.0
Initial publication