CVE-2007-3679 json
The Citrix EPA ActiveX control (aka the "endpoint checking control" or CCAOControl Object) before 4.5.0.0 in npCtxCAO.dll in Citrix Access…
published 2007-07-25 19 y ago modified 2026-06-16 4 mo ago also EUVD-2007-3663
- cvss
- 4.3
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.7%
- EPSS 1.7% chance of exploitation in 30 days, percentile 77%
- public exploits
- 0
- none known
Summary
The Citrix EPA ActiveX control (aka the "endpoint checking control" or CCAOControl Object) before 4.5.0.0 in npCtxCAO.dll in Citrix Access Gateway Standard Edition before 4.5.5 and Advanced Edition before 4.5 HF1 allows remote attackers to download and execute arbitrary programs onto a client system.
Patch / fix
Exploit prediction
1.68% chance of exploitation in the next 30 days, higher than 77% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
References
-
secunia.com
/advisories/26143
third-party-advisory, patch, vendor-advisory
-
securityfocus.com
/bid/24975
vdb-entry, patch
-
support.citrix.com
/article/CTX113815
patch
-
support.citrix.com
/article/CTX114028
patch
-
osvdb.org
/37845
vdb-entry
-
vupen.com
/english/advisories/2007/2583
vdb-entry
-
securityreason.com
/securityalert/2916
third-party-advisory
-
securityfocus.com
/archive/1/474204/100/0/threaded
mailing-list
- symantec.com /content/en/us/enterprise/research/SYMSA-2007-006.txt
-
securityfocus.com
/bid/24865
vdb-entry
-
exchange.xforce.ibmcloud.com
/vulnerabilities/35511
vdb-entry
Sources
- CVE List CVE-2007-3679
- NVD CVE-2007-3679
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.