CVE-2019-19169 - Dext5.ocx ActiveX 5.0.0.116 and eariler versions contain a vulnerability, which could allow remote attacker to download arbitrary file by setting the arguments to the activex method

Back Back to CVE browser

CRITICAL

Dext5.ocx ActiveX 5.0.0.116 and eariler versions contain a vulnerability, which could allow remote attacker to download arbitrary file by setting the arguments to the activex method

Published May 6, 2020

9.8

CRITICAL

CVSS 3.1

EPSS 1.61%

Description

Dext5.ocx ActiveX 5.0.0.116 and eariler versions contain a vulnerability, which could allow remote attacker to download arbitrary file by setting the arguments to the activex method. This can be leveraged for code execution.

Affected products

Vendor RAONwiz Product Dext.ocx ActiveX Control in Dext5 Upload Default
n/a
- Version
  5.0.0.116 and prior
  Status
  affected
  Constraints
  <5.0.0.117

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

RAONwiz

Dext.ocx ActiveX Control in Dext5 Upload

n/a

Version	Status	Constraints
5.0.0.116 and prior	affected	<5.0.0.117

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (3)

http://www.dext5.com/page/support/notice_view.aspx?pSeq=26
x_refsource_MISCVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-8801
Advisory
https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35353
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
http://www.dext5.com/page/support/notice_view.aspx?pSeq=26		x_refsource_MISCVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-8801		Advisory
https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35353		x_refsource_MISCThird Party Advisory