CVE-2009-0194
Last modified
CVE-2009-0194 is a vulnerability of currently unknown severity. The domain-locking implementation in the GARMINAXCONTROL.GarminAxControl_t.1 ActiveX control in npGarmin.dll in the Garmin Communicator Plug-In 2.6.4.0 does not properly enforce the restrictions that (1) download and (2) upload requests come from a web site specified by the user, which allows remote attackers to obtain sensitive information or reconfigure Garmin GPS devices via unspecified vectors related to a "synchronisation error.". EPSS estimates a 2.25% chance of exploitation in the next 30 days.
Description
The domain-locking implementation in the GARMINAXCONTROL.GarminAxControl_t.1 ActiveX control in npGarmin.dll in the Garmin Communicator Plug-In 2.6.4.0 does not properly enforce the restrictions that (1) download and (2) upload requests come from a web site specified by the user, which allows remote attackers to obtain sensitive information or reconfigure Garmin GPS devices via unspecified vectors related to a "synchronisation error."
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Garmin | Garmin Communicator Plugin | 2.6.4.0 |
References
- http://secunia.com/advisories/34326Vendor Advisory
- http://secunia.com/secunia_research/2009-16/Vendor Advisory
- http://secunia.com/advisories/34326Vendor Advisory
- http://secunia.com/secunia_research/2009-16/Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2009-0194?
How severe is CVE-2009-0194?
How do I fix CVE-2009-0194?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2009
- CVE-2009-0188Apple QuickTime before 7.6.2 allows remote attackers to exec…
- CVE-2009-0189Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
- CVE-2009-0190Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
- CVE-2009-0191Foxit Reader 2.3 before Build 3902 and 3.0 before Build 1506…
- CVE-2009-0192Off-by-one error in the iMonitor component in Novell eDirect…
- CVE-2009-0193Heap-based buffer overflow in Adobe Acrobat Reader 9 before …
- CVE-2009-0195Heap-based buffer overflow in Xpdf 3.02pl2 and earlier, CUPS…
- CVE-2009-0196Heap-based buffer overflow in the big2_decode_symbol_dict fu…
- CVE-2009-0197Integer overflow in the FORMATS Plugin before 4.23 for Irfan…
- CVE-2009-0198Heap-based buffer overflow in the JBIG2 filter in Adobe Read…
- CVE-2009-0199Heap-based buffer overflow in the VMnc media codec in vmnc.d…
- CVE-2009-0200Integer underflow in OpenOffice.org (OOo) before 3.1.1 and S…
Are you affected by CVE-2009-0194?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST