CVE-2009-0243 json
Microsoft Windows does not properly enforce the Autorun and NoDriveTypeAutoRun registry values, which allows physically proximate attackers…
published 2009-01-21 17 y ago modified 2026-06-16 4 mo ago also EUVD-2009-0251
- cvss
- 7.2
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 6.3%
- EPSS 6.3% chance of exploitation in 30 days, percentile 93%
- public exploits
- 0
- none known
Summary
Microsoft Windows does not properly enforce the Autorun and NoDriveTypeAutoRun registry values, which allows physically proximate attackers to execute arbitrary code by (1) inserting CD-ROM media, (2) inserting DVD media, (3) connecting a USB device, and (4) connecting a Firewire device; (5) allows user-assisted remote attackers to execute arbitrary code by mapping a network drive; and allows user-assisted attackers to execute arbitrary code by clicking on (6) an icon under My Computer\Devices with Removable Storage and (7) an option in an AutoPlay dialog, related to the Autorun.inf file. NOTE: vectors 1 and 3 on Vista are already covered by CVE-2008-0951.
Exploit prediction
6.28% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-16 Configuration
References
-
securitytracker.com
/id?1021629
vdb-entry
- isc.sans.org /diary.html?storyid=5695
-
us-cert.gov
/cas/techalerts/TA09-020A.html
third-party-advisory, us-government-resource
Sources
- CVE List CVE-2009-0243
- NVD CVE-2009-0243
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.