Security readout for executives and security teams
Plain-English summary
CVE-2017-2252 affects self-extracting archive files created by older SOURCENEXT File Compact versions. If one of these archives is run in an unsafe file location, a malicious DLL may be loaded and privileges gained. The public bundle does not provide a CVSS score, fixed version, or active exploitation evidence.
Executive priority
Prioritize discovery if the organization still uses or distributes legacy SOURCENEXT File Compact self-extracting archives. This is not currently KEV-listed, but privilege gain makes unmanaged legacy archives worth removing from trusted workflows.
Technical view
The issue is an untrusted search path vulnerability in self-extracting archives created by File Compact Ver.5 5.10 and earlier, Ver.6 6.02 and earlier, and Ver.7 7.02 and earlier. The advisory says privilege gain is possible via a Trojan horse DLL in an unspecified directory.
Likely exposure
Exposure is most likely where legacy self-extracting archives produced by affected File Compact versions are still stored, shared, or executed. Risk depends on execution context and local file placement, which are not fully specified in the source bundle.
Exploitation context
The sources describe a Trojan horse DLL scenario but do not cite public exploitation, exploitation in the wild, or CISA KEV listing. Treat active exploitation as unproven from the provided evidence.
Researcher notes
The public data is sparse: no CVSS vector, no CWE, no fixed version in the bundle, and the dangerous directory is unspecified. Validation should focus on asset provenance, affected version mapping, and vendor advisory confirmation rather than exploit reproduction.
Mitigation direction
- Inventory self-extracting archives created by affected File Compact versions.
- Check SOURCENEXT and JVN guidance for fixed versions or replacement instructions.
- Avoid executing affected archives from locations writable by untrusted users.
- Replace or recreate legacy archives only after confirming vendor-supported tooling.
- Use malware scanning and controlled distribution for retained archive files.
Validation and detection
- Identify whether File Compact Ver.5, Ver.6, or Ver.7 created retained archives.
- Confirm affected version thresholds against the CVE and JVN records.
- Review software repositories, downloads, and file shares for legacy self-extracting archives.
- Check whether affected archives execute in directories containing untrusted files.
- Document unknowns, including missing CVSS, unspecified directory, and absent exploit evidence.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-2252 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- JVN#29939155CVE reference · third-party-advisory, x_refsource_JVN
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.