CVE-2015-0925 Code injection in n/a
Remote authenticated users can execute arbitrary code on Windows via a crafted DLL pathname in a Unicode string processed by the iPass Open Mobile client.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-0925?
CVE-2015-0925 is a critical code injection vulnerability in n/a, published on 22 Jan 2015. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The client in iPass Open Mobile before 2.4.5 on Windows allows remote authenticated users to execute arbitrary code via a DLL pathname in a crafted Unicode string that is improperly handled by a subprocess reached through a named pipe, as demonstrated by a UNC share pathname.
Weakness: CWE-94
Which versions are affected by CVE-2015-0925?
It affects 1 product.
Products include Ipass Ipass Open Mobile.
How do I fix CVE-2015-0925?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2015-0925 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2015-0925 exists.
Public exploit code: 2 Metasploit modules and 1 Exploit-DB entry.
Sources
Also known as CLSA-2026-1774657370, GHSA-447v-97c3-8w6x.