RCE in Sunplus-Tech Dvr Remote Activex Control

CVE-2011-3828

DVRemoteAx.ax 2.1.0.39 in the DVR Remote ActiveX control allows remote attackers to execute arbitrary code via a crafted DVRobot.dll file in a manifest directory on a web server.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.029 (85.6th percentile) — read the EPSS interpretation.

Affected products

Sunplus-tech Dvr_remote_activex_control — versions 2.1.0.39
N/a — versions n/a

Weakness classification (CWE)

CWE-94 — Code Injection

References

PSIRT-CNA@flexerasoftware.com (mailing-list, x_refsource_BUGTRAQ)
PSIRT-CNA@flexerasoftware.com (x_refsource_MISC, Vendor Advisory)