{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "lang": "en-US",
    "publisher": {
      "category": "coordinator",
      "contact_details": "https://www.cisa.gov/report",
      "issuing_authority": "CISA",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "title": "Newell Brands DYMO ID multiple vulnerabilities",
    "tracking": {
      "current_release_date": "2026-10-05T19:42:46Z",
      "generator": {
        "engine": {
          "name": "VINCE-NT",
          "version": "1.15.1+build.152"
        }
      },
      "id": "VA-26-275-01",
      "initial_release_date": "2026-10-05T19:42:46Z",
      "status": "final",
      "version": "1.0.0",
      "revision_history": [
        {
          "number": "1.0.0",
          "summary": "Initial publication",
          "date": "2026-10-05T19:42:46Z"
        }
      ]
    },
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "notes": [
      {
        "text": "All information products included in [https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white](https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white) are provided \\\"as is\\\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see [https://us-cert.cisa.gov/tlp/](https://us-cert.cisa.gov/tlp/).",
        "title": "Legal Notice",
        "category": "legal_disclaimer"
      },
      {
        "text": "Worldwide",
        "title": "Countries and Areas Deployed",
        "category": "other"
      },
      {
        "text": "Information Technology",
        "title": "Critical Infrastructure Sectors",
        "category": "other"
      },
      {
        "text": "Newell Brands DYMO ID contains two vulnerabilities that could capture NTLMv2 credentials or code execution at a victim's privilege level after clicking on a crafted job file.",
        "title": "Risk Evaluation",
        "category": "summary"
      },
      {
        "text": "Fixed in 1.6.0.",
        "title": "Recommended Practices",
        "category": "general"
      },
      {
        "text": "United States",
        "title": "Company Headquarters Location",
        "category": "other"
      }
    ],
    "references": [
      {
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-275-01.json",
        "summary": "Vulnerability Advisory VA-26-275-01 CSAF",
        "category": "self"
      }
    ]
  },
  "product_tree": {
    "branches": [
      {
        "category": "vendor",
        "name": "Newell Brands",
        "branches": [
          {
            "category": "product_name",
            "name": "DYMO ID",
            "branches": [
              {
                "category": "product_version_range",
                "name": ">=1.5.1.71|<1.6.0",
                "product": {
                  "name": "Newell Brands DYMO ID >=1.5.1.71|<1.6.0",
                  "product_id": "CSAFPID-0001"
                }
              },
              {
                "category": "product_version",
                "name": "1.6.0",
                "product": {
                  "name": "Newell Brands DYMO ID 1.6.0",
                  "product_id": "CSAFPID-0002"
                }
              }
            ]
          },
          {
            "category": "product_name",
            "name": "DYMO ID",
            "branches": [
              {
                "category": "product_version_range",
                "name": ">=1.5.1.71|<1.6.0",
                "product": {
                  "name": "Newell Brands DYMO ID >=1.5.1.71|<1.6.0",
                  "product_id": "CSAFPID-0003"
                }
              },
              {
                "category": "product_version",
                "name": "1.6.0",
                "product": {
                  "name": "Newell Brands DYMO ID 1.6.0",
                  "product_id": "CSAFPID-0004"
                }
              }
            ]
          }
        ]
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-101893",
      "cwe": {
        "id": "CWE-611",
        "name": "Improper Restriction of XML External Entity Reference"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Newell Brands DYMO ID 1.5.1.71 parses job files using XmlDocument.Load() without disabling DTD processing. The PC Job Files view automatically parses every recognized job file extension on folder browse. A crafted file on any browsed network share can perform SSRF, capture NTLMv2 credentials, read local files, or crash the process. Fixed in 1.6.0.",
          "title": "Description"
        },
        {
          "category": "details",
          "title": "SSVC",
          "text": "SSVCv2/E:P/A:N/T:P/2026-10-02T15:34:09Z/"
        }
      ],
      "title": "Newell Brands DYMO ID document parsing failing file type extension authentication check",
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ],
        "fixed": [
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "mediaserver.newellrubbermaid.com",
          "url": "https://mediaserver.newellrubbermaid.com/industrial/Help/win/en/Content/What's%20New.htm"
        },
        {
          "category": "external",
          "summary": "www.dymo.com",
          "url": "https://www.dymo.com/support?cfid=user-guide"
        },
        {
          "category": "external",
          "summary": "VA-26-275-01",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-275-01.json"
        },
        {
          "category": "external",
          "summary": "CVE-2026-101893",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-101893"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Fixed in 1.6.0.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "date": "2026-10-02T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in 1.6.0.",
          "product_ids": [
            "CSAFPID-0002"
          ],
          "date": "2026-10-02T00:00:00Z"
        }
      ],
      "acknowledgments": [
        {
          "organization": "GetResponse S.A.",
          "names": [
            "Pawe\u0142 Karwowski"
          ]
        },
        {
          "organization": "GetResponse S.A.",
          "names": [
            "Bartosz Nowicki"
          ]
        }
      ],
      "release_date": "2026-10-02T00:00:00Z"
    },
    {
      "cve": "CVE-2026-102262",
      "cwe": {
        "id": "CWE-668",
        "name": "Exposure of Resource to Wrong Sphere"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to the process working directory. An attacker could store a job file alongside malicious modules / DLL that sets the process working directory to the job file's folder when a victim clicks on the file, resulting in code execution at the victim's privilege level. Fixed in 1.6.0.",
          "title": "Description"
        },
        {
          "category": "details",
          "title": "SSVC",
          "text": "SSVCv2/E:P/A:N/T:T/2026-10-01T14:37:33Z/"
        }
      ],
      "title": "Newell Brands DYMO ID parent directory open to path traversal through improper spheres of control",
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ],
        "fixed": [
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "mediaserver.newellrubbermaid.com",
          "url": "https://mediaserver.newellrubbermaid.com/industrial/Help/win/en/Content/What's%20New.htm"
        },
        {
          "category": "external",
          "summary": "www.dymo.com",
          "url": "https://www.dymo.com/support?cfid=user-guide"
        },
        {
          "category": "external",
          "summary": "VA-26-275-01",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-275-01.json"
        },
        {
          "category": "external",
          "summary": "CVE-2026-102262",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-102262"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Fixed in 1.6.0.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "date": "2026-10-02T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in 1.6.0.",
          "product_ids": [
            "CSAFPID-0002"
          ],
          "date": "2026-10-02T00:00:00Z"
        }
      ],
      "acknowledgments": [
        {
          "organization": "GetResponse S.A.",
          "names": [
            "Pawe\u0142 Karwowski"
          ]
        },
        {
          "organization": "GetResponse S.A.",
          "names": [
            "Bartosz Nowicki"
          ]
        }
      ],
      "release_date": "2026-10-02T00:00:00Z"
    }
  ]
}