CVE-2009-3735 — The ActiveScan Installer ActiveX control in as2stubie.dll before 1.3.3.0 in PandaActiveScan Installer 2.0 in Panda ActiveScan downloads software in an as2guiie.cab archive located at an arbitrary URL, and does not verify the archive's digital signature before installation, which allows remote attackers to execute arbitrary code via a URL argument to an unspecified method

Back Back to CVE browser

HIGH

The ActiveScan Installer ActiveX control in as2stubie.dll before 1.3.3.0 in PandaActiveScan Installer 2.0 in Panda ActiveScan downloads software in an as2guiie.cab archive located at an arbitrary URL, and does not verify the archive's digital signature before installation, which allows remote attackers to execute arbitrary code via a URL argument to an unspecified method

Published Feb 11, 2010

9.3

HIGH

CVSS 2.0

EPSS 5.74%

Description

The ActiveScan Installer ActiveX control in as2stubie.dll before 1.3.3.0 in PandaActiveScan Installer 2.0 in Panda ActiveScan downloads software in an as2guiie.cab archive located at an arbitrary URL, and does not verify the archive's digital signature before installation, which allows remote attackers to execute arbitrary code via a URL argument to an unspecified method.

Affected products

Remediation

No remediation recorded yet.

Metrics

5.74% 0.05743

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 2, 2026.

EPSS probability 0.05743

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (11 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 2, 2026	5.74% (0.05743)	92.83th	v5 (v2026.06.15)
Jun 15, 2026	5.74% (0.05743)	92.05th	v5 (v2026.06.15)
May 7, 2025	8.06% (0.08064)	91.64th	v4 (v2025.03.14)
Mar 30, 2025	10.17% (0.10175)	92.39th	v4 (v2025.03.14)
Mar 29, 2025	15.96% (0.15957)	91.32th	v4 (v2025.03.14)
Mar 17, 2025	10.17% (0.10175)	92.54th	v4 (v2025.03.14)
Dec 12, 2024	10.40% (0.10398)	95.25th	v3 (v2023.03.01)
Mar 7, 2023	10.40% (0.10398)	94.03th	v3 (v2023.03.01)
Mar 6, 2023	7.78% (0.07777)	93.24th	v2 (v2022.01.01)
Apr 1, 2022	7.78% (0.07777)	92.60th	v2 (v2022.01.01)
Feb 4, 2022	7.78% (0.07777)	81.54th	v2 (v2022.01.01)

Weaknesses (1)

CWE-94

Code Injection

References (6)

http://secunia.com/advisories/38485
third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://www.kb.cert.org/vuls/id/869993
third-party-advisoryx_refsource_CERT-VNUS Government Resource
http://www.kb.cert.org/vuls/id/MAPG-7QPKL3
x_refsource_MISC
http://www.securityfocus.com/bid/38067
vdb-entryx_refsource_BID
http://www.vupen.com/english/advisories/2010/0354
vdb-entryx_refsource_VUPENVendor Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-008
vendor-advisoryx_refsource_MS

Link	Providers	Tags
http://secunia.com/advisories/38485		third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://www.kb.cert.org/vuls/id/869993		third-party-advisoryx_refsource_CERT-VNUS Government Resource
http://www.kb.cert.org/vuls/id/MAPG-7QPKL3		x_refsource_MISC
http://www.securityfocus.com/bid/38067		vdb-entryx_refsource_BID
http://www.vupen.com/english/advisories/2010/0354		vdb-entryx_refsource_VUPENVendor Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-008		vendor-advisoryx_refsource_MS

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner certcc

Published Feb 11, 2010

Updated Aug 7, 2024

Reserved Oct 22, 2009

Link CVE-2009-3735

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 16, 2026

Link CVE-2009-3735

Red Hat

Severity n/a

Public date n/a

Links CVE-2009-3735