vulnwire
9.3crit

CVE-2008-4728in critical feed3 exploits

Multiple insecure method vulnerabilities in the DeployRun.DeploymentSetup.1 (DeployRun.dll) ActiveX control 10.0.0.44 in Hummingbird Deploy…

Published 18 y ago · modified 4 mo ago · JSON

CVSS
9.3
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
31.6%
percentile 98%
Public exploits
3
Exploit-DB

Multiple insecure method vulnerabilities in the DeployRun.DeploymentSetup.1 (DeployRun.dll) ActiveX control 10.0.0.44 in Hummingbird Deployment Wizard 2008 allow remote attackers to execute arbitrary programs via the (1) Run and (2) PerformUpdateAsync methods, and (3) modify arbitrary registry values via the SetRegistryValueAsString method. NOTE: the SetRegistryValueAsString method could be leveraged for code execution by specifying executable file values to Startup folders.

Exploit prediction (EPSS)

31.63% probability of exploitation in the next 30 days, higher than 98% of all scored CVEs.

Exploits and detections

  • EDB-6776 Hummingbird Deployment Wizard 2008 - ActiveX File Execution(2) · remote · 2008-10-17
  • EDB-6774 Hummingbird Deployment Wizard 2008 - Registry Values Creation/Change · remote · 2008-10-17
  • EDB-6773 Hummingbird Deployment Wizard 2008 - ActiveX Command Execution · remote · 2008-10-17

CVSS scores

Assigned byVersionScoreVector
NVD2.09.3AV:N/AC:M/Au:N/C:C/I:C/A:C

References

  • exploit-db.com /exploits/6773 · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • shinnai.net /xplits/TXT_2XfQ1sHruhjaoePszNTG.html · x_refsource_MISC, x_transferred
  • exploit-db.com /exploits/6774 · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • securityfocus.com /bid/31799 · vdb-entry, x_refsource_BID, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/45961 · vdb-entry, x_refsource_XF, x_transferred
  • exploit-db.com /exploits/6776 · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • vupen.com /english/advisories/2008/2857 · vdb-entry, x_refsource_VUPEN, x_transferred
  • secunia.com /advisories/32337 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • shinnai.net /xplits/TXT_L0z0Mimixdsko8kI6VFW.html · x_refsource_MISC, x_transferred
  • shinnai.net /xplits/TXT_JqLchaIAfq4kSH0NsvJO.html · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.