CVE-2007-6506

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 16.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2007-12-20 · updated 2026-06-16

Description

The HPRulesEngine.ContentCollection.1 ActiveX Control in RulesEngine.dll for HP Software Update 4.000.005.007 and earlier, including 3.0.8.4, allows remote attackers to (1) overwrite and corrupt arbitrary files via arguments to the SaveToFile method, and possibly (2) access arbitrary files via the LoadDataFromFile method.

Affected products

HP Software Update: through 4.000.005.007; 3.0.8.4

References

http://blogs.zdnet.com/security/?p=768
http://computerworld.com/action/article.do?command=viewArticleBasic&articleId=9053818
http://it.slashdot.org/it/07/12/20/2327242.shtml
http://secunia.com/advisories/28177
http://www.anspi.pl/~porkythepig/hp-issue/wyfukanyszynszyl.txt
http://www.securityfocus.com/archive/1/485451/100/0/threaded
http://www.securityfocus.com/archive/1/485734/100/0/threaded
http://www.securityfocus.com/bid/26950
http://www.securitytracker.com/id?1019133
http://www.vupen.com/english/advisories/2007/4271
https://exchange.xforce.ibmcloud.com/vulnerabilities/39153
https://www.exploit-db.com/exploits/4757

Get alerted when CVE-2007-6506 or the next vulnerability affects your stack