Vulnerability in Garmin Communicator Plugin

CVE-2009-0194

The domain-locking implementation in the GARMINAXCONTROL.GarminAxControl_t.1 ActiveX control in npGarmin.dll in the Garmin Communicator Plug-In 2.6.4.0 does not properly enforce the restrictions that (1) download and (2) upload requests come from a web site specified by the user, which allows remote attackers to obtain sensitive information or reconfigure Garmin GPS devices via unspecified vectors related to a "synchronisation error."

EPSS: 0.023 (81.1th percentile) — read the EPSS interpretation.

Affected products

Garmin Garmin_communicator_plugin — versions 2.6.4.0
N/a — versions n/a

Weakness classification (CWE)

CWE-264

References

PSIRT-CNA@flexerasoftware.com (vdb-entry, x_refsource_XF)
PSIRT-CNA@flexerasoftware.com (x_refsource_MISC, Vendor Advisory)
PSIRT-CNA@flexerasoftware.com (vdb-entry, x_refsource_SECTRACK)
PSIRT-CNA@flexerasoftware.com (mailing-list, x_refsource_BUGTRAQ)
PSIRT-CNA@flexerasoftware.com (vdb-entry, x_refsource_BID)
PSIRT-CNA@flexerasoftware.com (x_refsource_OSVDB, vdb-entry)
PSIRT-CNA@flexerasoftware.com (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)