CVE-2009-3735

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2010-02-11 · updated 2026-06-16
Weakness: CWE-94

Description

The ActiveScan Installer ActiveX control in as2stubie.dll before 1.3.3.0 in PandaActiveScan Installer 2.0 in Panda ActiveScan downloads software in an as2guiie.cab archive located at an arbitrary URL, and does not verify the archive's digital signature before installation, which allows remote attackers to execute arbitrary code via a URL argument to an unspecified method.

Affected products

Panda Activescan: 2.0

References

http://secunia.com/advisories/38485
http://www.kb.cert.org/vuls/id/869993
http://www.kb.cert.org/vuls/id/MAPG-7QPKL3
http://www.securityfocus.com/bid/38067
http://www.vupen.com/english/advisories/2010/0354
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-008
http://secunia.com/advisories/38485
http://www.kb.cert.org/vuls/id/869993
http://www.kb.cert.org/vuls/id/MAPG-7QPKL3
http://www.securityfocus.com/bid/38067
http://www.vupen.com/english/advisories/2010/0354
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-008

Get alerted when CVE-2009-3735 or the next vulnerability affects your stack