CVE-2009-3735 json
The ActiveScan Installer ActiveX control in as2stubie.dll before 1.3.3.0 in PandaActiveScan Installer 2.0 in Panda ActiveScan downloads sof…
published 2010-02-11 16 y ago modified 2026-06-16 4 mo ago also EUVD-2009-3707
- cvss
- 9.3
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 5.7%
- EPSS 5.7% chance of exploitation in 30 days, percentile 93%
- public exploits
- 0
- none known
Summary
The ActiveScan Installer ActiveX control in as2stubie.dll before 1.3.3.0 in PandaActiveScan Installer 2.0 in Panda ActiveScan downloads software in an as2guiie.cab archive located at an arbitrary URL, and does not verify the archive's digital signature before installation, which allows remote attackers to execute arbitrary code via a URL argument to an unspecified method.
Exploit prediction
5.74% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-94 Improper Control of Generation of Code
References
-
docs.microsoft.com
/en-us/security-updates/securitybulletins/2010/ms10-008
vendor-advisory
-
vupen.com
/english/advisories/2010/0354
vdb-entry, vendor-advisory
-
secunia.com
/advisories/38485
third-party-advisory, vendor-advisory
- kb.cert.org /vuls/id/MAPG-7QPKL3
-
securityfocus.com
/bid/38067
vdb-entry
-
kb.cert.org
/vuls/id/869993
third-party-advisory, us-government-resource
Sources
- CVE List CVE-2009-3735
- NVD CVE-2009-3735
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.