SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2012-0266

Multiple stack-based buffer overflows in the NTR ActiveX control before 2.0.4.8 allow remote attackers to execute arbitrary code via (1) a long bstrUrl parameter to the StartModule method, (2) a long bstrParams parameter to the Check method, a long…

HIGH 9.3EPSS 42.3%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 42.3%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.

Description

Multiple stack-based buffer overflows in the NTR ActiveX control before 2.0.4.8 allow remote attackers to execute arbitrary code via (1) a long bstrUrl parameter to the StartModule method, (2) a long bstrParams parameter to the Check method, a long bstrUrl parameter to the (3) Download or (4) DownloadModule method during construction of a .ntr pathname, or a long bstrUrl parameter to the (5) Download or (6) DownloadModule method during construction of a URL.

CVSS 2.0
9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
EPSS
42.28% probability · 99th percentile
CISA KEV
Not listed
Weakness
CWE-119
Affected
ntrglobal/ntr activex control
Source
PSIRT-CNA@flexerasoftware.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.