PatchTheCVECVE-2017-2154: Untrusted search path vulnerability in Hanako 2017, Hanako 2016, Hanako 2015, Hanako Pro 3, JUST Office 3 [Sta
44
This month
HIGH 7.8DOWNGRADEDOWNGRADEDOWNGRADE
CVE-2017-2154 is a high-severity flaw (CVSS 7.8) affecting hanako, hanako police, hanako pro. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Untrusted search path vulnerability in Hanako 2017, Hanako 2016, Hanako 2015, Hanako Pro 3, JUST Office 3 [Standard], JUST Office 3 [Eco Print Package], JUST Office 3 & Tri-De DataProtect Package, JUST Government 3, JUST Jump Class 2, JUST Frontier 3, JUST School 6 Premium, Hanako Police 5, JUST Police 3, Hanako 2017 trial version allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
Why this priority
- High severity
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 7.8 (High) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 1.2% (top 32%) |
| CISA exploited list | No |
| Weakness | CWE-20 |
| Published | 2017-04-28 |
| Last modified | 2026-06-17 |
Publisher (CNA): JPCERT/CC · Vendor: justsystems
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
justsystems hanako DOWNGRADE
Affected: 2015 · 2016 · 2017
Fixed in: no fixed release known
Safe to downgrade to: a release before 2015
1. Check installed version
apt-cache policy hanako || rpm -q hanako || hanako --version
2. No fixed release: DOWNGRADE to a release before 2015 (Debian / Ubuntu)
apt-cache madison hanako
sudo apt install hanako=<VERSION_BEFORE_2015>
sudo apt-mark hold hanako
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list hanako
sudo dnf downgrade hanako-<VERSION_BEFORE_2015>
sudo dnf versionlock add hanako
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
justsystems hanako police DOWNGRADE
Affected: 5
Fixed in: no fixed release known
Safe to downgrade to: a release before 5
1. Check installed version
apt-cache policy hanako-police || rpm -q hanako-police || hanako-police --version
2. No fixed release: DOWNGRADE to a release before 5 (Debian / Ubuntu)
apt-cache madison hanako-police
sudo apt install hanako-police=<VERSION_BEFORE_5>
sudo apt-mark hold hanako-police
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list hanako-police
sudo dnf downgrade hanako-police-<VERSION_BEFORE_5>
sudo dnf versionlock add hanako-police
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
justsystems hanako pro DOWNGRADE
Affected: 3
Fixed in: no fixed release known
Safe to downgrade to: a release before 3
1. Check installed version
apt-cache policy hanako-pro || rpm -q hanako-pro || hanako-pro --version
2. No fixed release: DOWNGRADE to a release before 3 (Debian / Ubuntu)
apt-cache madison hanako-pro
sudo apt install hanako-pro=<VERSION_BEFORE_3>
sudo apt-mark hold hanako-pro
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list hanako-pro
sudo dnf downgrade hanako-pro-<VERSION_BEFORE_3>
sudo dnf versionlock add hanako-pro
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
justsystems just frontier DOWNGRADE
Affected: 3
Fixed in: no fixed release known
Safe to downgrade to: a release before 3
1. Check installed version
apt-cache policy just-frontier || rpm -q just-frontier || just-frontier --version
2. No fixed release: DOWNGRADE to a release before 3 (Debian / Ubuntu)
apt-cache madison just-frontier
sudo apt install just-frontier=<VERSION_BEFORE_3>
sudo apt-mark hold just-frontier
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list just-frontier
sudo dnf downgrade just-frontier-<VERSION_BEFORE_3>
sudo dnf versionlock add just-frontier
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
justsystems just government DOWNGRADE
Affected: 3
Fixed in: no fixed release known
Safe to downgrade to: a release before 3
1. Check installed version
apt-cache policy just-government || rpm -q just-government || just-government --version
2. No fixed release: DOWNGRADE to a release before 3 (Debian / Ubuntu)
apt-cache madison just-government
sudo apt install just-government=<VERSION_BEFORE_3>
sudo apt-mark hold just-government
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list just-government
sudo dnf downgrade just-government-<VERSION_BEFORE_3>
sudo dnf versionlock add just-government
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
justsystems just jump class DOWNGRADE
Affected: 2
Fixed in: no fixed release known
Safe to downgrade to: a release before 2
1. Check installed version
apt-cache policy just-jump-class || rpm -q just-jump-class || just-jump-class --version
2. No fixed release: DOWNGRADE to a release before 2 (Debian / Ubuntu)
apt-cache madison just-jump-class
sudo apt install just-jump-class=<VERSION_BEFORE_2>
sudo apt-mark hold just-jump-class
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list just-jump-class
sudo dnf downgrade just-jump-class-<VERSION_BEFORE_2>
sudo dnf versionlock add just-jump-class
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2017-2154?
hanako: downgrade or apply the listed mitigation; hanako police: downgrade or apply the listed mitigation; hanako pro: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2017-2154 being exploited?
CVE-2017-2154 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2017-2154 affect?
CVE-2017-2154 affects hanako, hanako police, hanako pro. Severity is high (CVSS 7.8). Untrusted search path vulnerability in Hanako 2017, Hanako 2016, Hanako 2015, Hanako Pro 3, JUST Office 3 [Standard], JUST Office 3 [Eco Print Package], JUST Office 3 & Tri-De DataProtect Package, JUST Government 3, JUST Jump Class 2, JUST
How urgent is CVE-2017-2154?
Priority 44/100. High severity
Related CVEs
- CVE-2013-0707 HIGH 9.3 DOWNGRADE DOWNGRADE Unspecified vulnerability in JustSystems Ichitaro 2006 and 2007, Ichitaro Government 2006 and 2007, Ichitaro P