What’s Vulnerable › Vulnerabilities

CVE-2009-1064

• Severity: medium (CVSS 5.8 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2009-03-26 · updated 2026-06-16
• Weakness: CWE-94

Description

Argument injection vulnerability in orbitmxt.dll 2.1.0.2 in the Orbit Downloader 2.8.7 and earlier ActiveX control allows remote attackers to overwrite arbitrary files via whitespace and a command-line switch, followed by a full pathname, in the third argument to the download method.

Affected products

• Orbit Downloader: 2.6.3, 2.6.4
• Orbitdownloader Orbit Downloader: through 2.8.7; 2.6.1, 2.6.3, 2.6.4, 2.6.5, 2.7.1, 2.7.3 (+10)

References

• http://www.securityfocus.com/bid/34200
• http://www.waraxe.us/advisory-73.html
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49353
• https://www.exploit-db.com/exploits/8257
• http://www.securityfocus.com/bid/34200
• http://www.waraxe.us/advisory-73.html
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49353
• https://www.exploit-db.com/exploits/8257

Get alerted when CVE-2009-1064 or the next vulnerability affects your stack