Vulnerability Details : CVE-2012-4177

Public exploit exists!
The web browser plugin for Ubisoft Uplay PC before 2.0.4 allows remote attackers to execute arbitrary programs via the -orbit_exe_path command line argument.
Published 2012-08-07 20:55:04
Updated 2013-04-02 03:19:52
Source MITRE
View at NVD,   CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2012-4177

EPSS FAQ
84.85%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 99 %
Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2012-4177

  • Ubisoft uplay 2.0.3 ActiveX Control Arbitrary Code Execution
    Disclosure Date: 2012-07-29
    First seen: 2020-04-26
    exploit/windows/browser/ubisoft_uplay_cmd_exec
    The uplay ActiveX component allows an attacker to execute any command line action. User must sign in, unless auto-sign in is enabled and uplay must not already be running. Due to the way the malicious executable is served (WebDAV), the module must be run on port 80,

CVSS scores for CVE-2012-4177

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
10.0
 HIGH AV:N/AC:L/Au:N/C:C/I:C/A:C
10.0
10.0
 NIST

CWE ids for CVE-2012-4177

References for CVE-2012-4177

Products affected by CVE-2012-4177

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close