CVE-2004-0199

Severity: medium (CVSS 5.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 26.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2004-06-14 · updated 2026-06-16

Description

Help and Support Center in Microsoft Windows XP and Windows Server 2003 SP1 does not properly validate HCP URLs, which allows remote attackers to execute arbitrary code, as demonstrated using certain hcp:// URLs that access the DVD Upgrade capability (dvdupgrd.htm).

Affected products

Microsoft Windows 2003 Server: enterprise, enterprise_64-bit, r2, standard, web
Microsoft Windows XP Service Pack 3: all versions

References

http://marc.info/?l=bugtraq&m=108437759930820&w=2
http://marc.info/?l=full-disclosure&m=108430407801825&w=2
http://www.exploitlabs.com/files/advisories/EXPL-A-2004-001-helpctr.txt
http://www.kb.cert.org/vuls/id/484814
http://www.securityfocus.com/bid/10321
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-015
https://exchange.xforce.ibmcloud.com/vulnerabilities/16095
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1008
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1032
http://marc.info/?l=bugtraq&m=108437759930820&w=2
http://marc.info/?l=full-disclosure&m=108430407801825&w=2
http://www.exploitlabs.com/files/advisories/EXPL-A-2004-001-helpctr.txt

Get alerted when CVE-2004-0199 or the next vulnerability affects your stack