CVE-2012-3809

published 2020-01-09

CVE-2012-3809: Samsung Kies before 2.5.0.12094_27_11 has arbitrary directory modification.

Priority P3 53 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C N I H A N

EXPLOIT

Samsung Kies before 2.5.0.12094_27_11 has arbitrary directory modification.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
samsung	kies	< 2.5.0.12094_27_11	2.5.0.12094_27_11

Detection & IOCs extracted from sources · hover to see the quote

path C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\CmdAgent.dll↗

other GUID: {1FA56F8D-A66E-4ABD-9BC9-6F61469E59AD} (CmdAgentLib)↗

other GUID: {C668B648-A2BD-432C-854F-C8C0A275E1F1} (CommandAgent class)↗

command DirCreate↗

command DirDelete↗

• → Monitor for ActiveX instantiation of CmdAgentLib GUID {1FA56F8D-A66E-4ABD-9BC9-6F61469E59AD} from untrusted (browser/web) contexts, particularly calls to DirCreate or DirDelete methods via the ICommandAgent interface. ↗
• → Alert on unexpected directory creation or deletion operations originating from CmdAgent.dll (Samsung Kies FirmwareUpdate component) in the path C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\. ↗
• → Flag Samsung Kies versions prior to 2.5.0.12094_27_11 (e.g., 2.3.2.12054_20) as vulnerable; inventory and alert on presence of these versions in the environment. ↗

• · The vulnerable ActiveX control (CmdAgent.dll / CmdAgentLib) exposes its ICommandAgent interface to untrusted sources without access control, meaning any web page can invoke directory modification methods if the control is installed and not kill-bitted. ↗

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:N/I:P/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.