CVE-2015-0925

high · 9

The client in iPass Open Mobile before 2.4.5 on Windows allows remote authenticated users to execute arbitrary code via a DLL pathname in a crafted Unicode string that is improperly handled by a subprocess reached through a named pipe, as demonstrated by a UNC share pathname.

CVSS

52.2%

EPSS (exploit prob.)

99th

EPSS percentile

2015-01-22

Published

AV:N/AC:L/Au:S/C:C/I:C/A:C

Weaknesses

CWE-94

Affected products

Vendor	Product	Affected versions
ipass	ipass_open_mobile	<= 2.4.4

Check a specific version with /api/v1/cve/match.

References

http://www.kb.cert.org/vuls/id/110652
http://www.kb.cert.org/vuls/id/110652

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2015-0925