CVE-2008-4728
Multiple insecure method vulnerabilities in the DeployRun.DeploymentSetup.1 (DeployRun.dll) ActiveX control 10.0.0.44 in Hummingbird Deployment Wizard 2008 allow remote attackers to execute arbitrary programs via the (1) Run and (2) PerformUpdateAsync…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 31.6%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
Multiple insecure method vulnerabilities in the DeployRun.DeploymentSetup.1 (DeployRun.dll) ActiveX control 10.0.0.44 in Hummingbird Deployment Wizard 2008 allow remote attackers to execute arbitrary programs via the (1) Run and (2) PerformUpdateAsync methods, and (3) modify arbitrary registry values via the SetRegistryValueAsString method. NOTE: the SetRegistryValueAsString method could be leveraged for code execution by specifying executable file values to Startup folders.
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 31.63% probability · 98th percentile
- CISA KEV
- Not listed
- Affected
- hummingbird/deployment wizard
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/32337Vendor Advisory
- http://www.securityfocus.com/bid/31799
- http://www.shinnai.net/xplits/TXT_2XfQ1sHruhjaoePszNTG.htmlExploit, URL Repurposed
- http://www.shinnai.net/xplits/TXT_JqLchaIAfq4kSH0NsvJO.htmlExploit, URL Repurposed
- http://www.shinnai.net/xplits/TXT_L0z0Mimixdsko8kI6VFW.htmlExploit, URL Repurposed
- http://www.vupen.com/english/advisories/2008/2857
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45961
- https://www.exploit-db.com/exploits/6773
- https://www.exploit-db.com/exploits/6774
- https://www.exploit-db.com/exploits/6776
- http://secunia.com/advisories/32337Vendor Advisory
- http://www.securityfocus.com/bid/31799
- http://www.shinnai.net/xplits/TXT_2XfQ1sHruhjaoePszNTG.htmlExploit, URL Repurposed
- http://www.shinnai.net/xplits/TXT_JqLchaIAfq4kSH0NsvJO.htmlExploit, URL Repurposed
- http://www.shinnai.net/xplits/TXT_L0z0Mimixdsko8kI6VFW.htmlExploit, URL Repurposed
- http://www.vupen.com/english/advisories/2008/2857
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45961
- https://www.exploit-db.com/exploits/6773
- https://www.exploit-db.com/exploits/6774
- https://www.exploit-db.com/exploits/6776
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.