Newell Brands DYMO ID vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Newell Brands DYMO ID: 2 record(s), with affected versions and fixes.

CVE-2026-102262 High · 7.3 CWE-22 Oct 5, 2026

Newell Brands DYMO ID parent directory open to path traversal through improper spheres of control

Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to the process working directory. An attacker could store a job file alongside malicious modules / DLL that sets the process working directory to the job file's folder when a victim clicks on the file, resulting in code execution at the victim's privilege level. Fixed in 1.6.0.

CVE-2026-101893 Medium · 4.4 CWE-611 Oct 5, 2026

Newell Brands DYMO ID document parsing failing file type extension authentication check

Newell Brands DYMO ID 1.5.1.71 parses job files using XmlDocument.Load() without disabling DTD processing. The PC Job Files view automatically parses every recognized job file extension on folder browse. A crafted file on any browsed network share can perform SSRF, capture NTLMv2 credentials, read local files, or crash the process. Fixed in 1.6.0.