Description
Newell Brands DYMO ID 1.5.1.71 parses job files using XmlDocument.Load() without disabling DTD processing. The PC Job Files view automatically parses every recognized job file extension on folder browse. A crafted file on any browsed network share can perform SSRF, capture NTLMv2 credentials, read local files, or crash the process. Fixed in 1.6.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Newell Brands | DYMO ID | 1.5.1.71 – < 1.6.0 | 1.6.0 |
Advisories 1
- VA-26-275-01 Newell Brands DYMO ID multiple vulnerabilities CISA ICS & IT advisories · Oct 5, 2026