CVE-2009-0811 json
Insecure method vulnerability in the SopCast SopCore ActiveX control in sopocx.ocx 3.0.3.501 allows remote attackers to execute arbitrary p…
published 2009-03-04 17 y ago modified 2026-06-16 4 mo ago also EUVD-2009-0809
- cvss
- 9.3
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 5.5%
- EPSS 5.5% chance of exploitation in 30 days, percentile 92%
- public exploits
- 1
- Exploit-DB
Summary
Insecure method vulnerability in the SopCast SopCore ActiveX control in sopocx.ocx 3.0.3.501 allows remote attackers to execute arbitrary programs via an executable file name in the argument to the SetExternalPlayer method.
Timeline
- First public exploit (EDB-8143)
- Published
Exploit prediction
5.54% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-8143 Sopcast SopCore Control - 'sopocx.ocx' Command Execution remote, 2009-03-03
- securityfocus.com http://www.securityfocus.com/bid/33920 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-94 Improper Control of Generation of Code
References
-
securityfocus.com
/bid/33920
vdb-entry, exploit
-
exchange.xforce.ibmcloud.com
/vulnerabilities/48955
vdb-entry
- retrogod.altervista.org /9sg_sopcastia.html
-
securityfocus.com
/archive/1/501252/100/0/threaded
mailing-list
Sources
- CVE List CVE-2009-0811
- NVD CVE-2009-0811
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.