NetMod VPN Client DLL Injection Vulnerability Allowing Arbitrary Code Execution

A DLL injection vulnerability has been identified in NetMod VPN Client version 5.3.1. This issue allows attackers to execute arbitrary code by placing a malicious DLL in a directory from which the application loads its dependencies. The vulnerability stems from inadequate validation of dynamically loaded libraries. When the application is launched, it inadvertently loads the malicious DLL, leading to unauthorized code execution.

Impact

Exploitation of this vulnerability allows for privilege escalation, as the executed code inherits elevated rights. This could result in a complete system compromise, unauthorized access, and the potential for persistent threats on the affected machine.

Reproduction

The vulnerability can be reproduced by crafting a malicious DLL and placing it in a directory where NetMod VPN Client loads its dependencies. When the application is run, it will load the injected DLL instead of a legitimate one, executing the embedded code. This has been demonstrated by using a DLL that, when injected, launches the Windows calculator application, calc.exe.