Administrator code execution via writable DLL search path

DLL search-order hijacking in OMRON PowerAttendant Standard Edition 2.1.2 and earlier allows local users to execute code as administrator. During service startup, the executable searches its own installation directory for a missing DLL and loads an attacker-planted library because low-privilege users can write there. Exploitation requires local low-privilege access and a service start; the library then runs with administrator privileges and can fully control the host.