vulnwire
9.3crit

CVE-2008-4342in critical feed1 exploit

NuMedia Soft NMS DVD Burning SDK Activex NMSDVDX.DVDEngineX.1 ActiveX control (NMSDVDX.dll) 1.013C and earlier, as used in CDBurnerXP 4.2.1…

Published 18 y ago · modified 4 mo ago · JSON

CVSS
9.3
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
17.2%
percentile 97%
Public exploits
1
Exploit-DB

NuMedia Soft NMS DVD Burning SDK Activex NMSDVDX.DVDEngineX.1 ActiveX control (NMSDVDX.dll) 1.013C and earlier, as used in CDBurnerXP 4.2.1.976, BurnAware 2.1.3, Blaze Media Pro 8.02 Special Edition, and possibly other products, allows remote attackers to overwrite and create arbitrary files via calls to the EnableLog and LogMessage methods. NOTE: this issue might only be exploitable in limited environments or non-default browser settings. NOTE: some of these details are obtained from third party information. NOTE: this can be leveraged for remote code execution by accessing files using hcp:// URLs.

Exploit prediction (EPSS)

17.20% probability of exploitation in the next 30 days, higher than 97% of all scored CVEs.

Exploits and detections

  • EDB-6491 NuMedia Soft Nms DVD Burning SDK - ActiveX 'NMSDVDX.dll' Command Execution · remote · 2008-09-19

CVSS scores

Assigned byVersionScoreVector
NVD2.09.3AV:N/AC:M/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-20 Improper Input Validation

References

  • secunia.com /advisories/31936 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • shinnai.net /xplits/TXT_TrWE9AJA8nQpuFsnxBcq · x_refsource_MISC, x_transferred
  • exploit-db.com /exploits/6491 · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • vupen.com /english/advisories/2008/2663 · vdb-entry, x_refsource_VUPEN, x_transferred
  • securityfocus.com /archive/1/497831/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/45330 · vdb-entry, x_refsource_XF, x_transferred
  • secunia.com /advisories/32455 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/31949 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • securityfocus.com /bid/31374 · vdb-entry, x_refsource_BID, x_transferred
  • retrogod.altervista.org /9sg_numedia_xpl.html · x_refsource_MISC, x_transferred
  • secunia.com /advisories/31950 · third-party-advisory, x_refsource_SECUNIA, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.