CVE-2012-3807

published 2020-01-09

CVE-2012-3807: Samsung Kies before 2.5.0.12094_27_11 has arbitrary file execution.

Priority P2 71 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

Samsung Kies before 2.5.0.12094_27_11 has arbitrary file execution.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
samsung	kies	< 2.5.0.12094_27_11	2.5.0.12094_27_11

Detection & IOCs extracted from sources · hover to see the quote

path C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\CmdAgent.dll↗

path C:\Program Files(x86)\Samsung\Kies\External\DeviceModules\DCAPARAGONGM.dll↗

other GUID: {1FA56F8D-A66E-4ABD-9BC9-6F61469E59AD} (CmdAgentLib)↗

other GUID: {C668B648-A2BD-432C-854F-C8C0A275E1F1} (CommandAgent class)↗

other GUID: {7650BC47-036D-4D5B-95B4-9D622C8D00A4} (DeviceDataParagonATGM ActiveX)↗

command daTarget.Run daFile↗

• → Monitor for ActiveX instantiation of CLSID {1FA56F8D-A66E-4ABD-9BC9-6F61469E59AD} (CmdAgentLib) or {C668B648-A2BD-432C-854F-C8C0A275E1F1} (CommandAgent) from browser or untrusted web content, which exposes arbitrary file execution via the Run/RunNotExit methods. ↗
• → Alert on calls to ICommandAgent methods Run and RunNotExit from web-facing processes (e.g., iexplore.exe, browser child processes), as these are confirmed vulnerable for arbitrary file execution. ↗
• → Detect file system operations (FileCopy, FileCopySync, FileDelete, FileMove, FileMoveSync) and directory operations (DirCreate, DirDelete) invoked via the CmdAgent ActiveX control from browser context, indicating exploitation of CVE-2012-3808/3809. ↗
• → Monitor for registry key creation/deletion under HKEY_CURRENT_USER initiated by CmdAgent.dll ActiveX methods (RegiCreateKey, RegiDeleteKey, RegiSetValueString, RegiSetValueInt, etc.) from browser processes. ↗
• → Flag presence of CmdAgent.dll in C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\ on systems where Samsung Kies version is below 2.5.0.12094_27_11, as all versions up to 2.3.2.12054_20 are confirmed vulnerable. ↗

• · The vulnerable ActiveX controls are only exploitable when instantiated from a browser (e.g., Internet Explorer) visiting a malicious web page; the controls must not be marked kill-bit in the registry to be reachable. ↗
• · RunAt and RunAtNotExit methods failed initial exploit testing and may not be reliably exploitable, whereas Run and RunNotExit are confirmed vulnerable. ↗
• · FileMoveExReboot also failed initial exploit testing and may not be reliably exploitable for arbitrary file movement. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.