VULNERABILITY INTELLIGENCE
CVE-2009-1064
CVSS score5.8 MEDIUM
EPSS probability3.72%
CISA KEVNot currently listed
Published2009-03-26
Last modified2026-06-16
CVSS vectorAV:N/AC:M/Au:N/C:N/I:P/A:P
Description
Argument injection vulnerability in orbitmxt.dll 2.1.0.2 in the Orbit Downloader 2.8.7 and earlier ActiveX control allows remote attackers to overwrite arbitrary files via whitespace and a command-line switch, followed by a full pathname, in the third argument to the download method.
Weakness classification
- CWE-94: Improper Control of Generation of Code ('Code Injection')