PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-5161 Sielcosistemi CVE debrief

CVE-2017-5161 describes an uncontrolled search path element (DLL hijacking) issue in Sielco Sistemi Winlog Lite and Winlog Pro SCADA software. According to the CVE description, affected versions are those prior to Version 3.02.01, and successful exploitation could let an attacker run code with the same privilege level as the application that loads the malicious DLL. The record is associated with ICS-CERT mitigation guidance and an NVD CWE-427 classification.

Vendor
Sielcosistemi
Product
CVE-2017-5161
CVSS
HIGH 7.2
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-13
Original CVE updated
2026-05-13
Advisory published
2017-02-13
Advisory updated
2026-05-13

Who should care

Operators and administrators of Winlog Lite and Winlog Pro deployments, especially in industrial or SCADA environments, should care. Security teams responsible for Windows-based HMI/SCADA workstations, engineering stations, and any system that launches these applications should validate exposure and patch status.

Technical summary

The vulnerability is an uncontrolled search path element / DLL hijacking weakness (CWE-427). In practical terms, if the application searches unsafe locations for a DLL, a malicious DLL may be loaded instead of the intended one. NVD classifies the issue with CVSS v3.0 vector AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H, indicating local access conditions, high complexity, required privileges, and user interaction. The supplied CVE description states the impact is execution at the same privilege level as the application that uses the malicious DLL.

Defensive priority

High for any environment running affected Winlog Lite or Winlog Pro versions. Although the CVSS vector reflects nontrivial exploitation conditions, the potential impact in SCADA contexts is severe enough to justify prompt inventory, version verification, and remediation.

Recommended defensive actions

  • Upgrade Sielco Sistemi Winlog Lite and Winlog Pro to Version 3.02.01 or later, as stated in the CVE description.
  • Inventory all systems running Winlog Lite and Winlog Pro and confirm whether installed versions are prior to the fixed release.
  • Review application launch paths and DLL loading behavior on exposed Windows systems to identify unsafe search-path usage.
  • Restrict who can log on locally to affected engineering or operator stations, since the CVSS vector indicates local access and required privileges.
  • Apply vendor or ICS-CERT mitigation guidance referenced in the NVD record and track any site-specific compensating controls.
  • Treat the issue as especially important on systems that support operational technology workflows, where application-level compromise can have broader process impacts.

Evidence notes

Primary facts come from the supplied CVE description and NVD metadata: affected products are Winlog Lite and Winlog Pro, versions prior to 3.02.01, with an uncontrolled search path element / DLL hijacking weakness mapped to CWE-427. NVD also supplies the CVSS v3.0 vector AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H. The source corpus includes an ICS-CERT advisory reference (ICSA-17-038-01) and a SecurityFocus BID entry (96119) as supporting mitigation and third-party references. The CVE publication date used for timing context is 2017-02-13; the later 2026 modified timestamp reflects metadata updates, not the original issue date.

Official resources

Publicly disclosed in the CVE record on 2017-02-13. This debrief is based on the supplied public CVE/NVD corpus and references a later NVD metadata modification date of 2026-05-13 without treating it as the issue date.