CVE-2009-0194
The domain-locking implementation in the GARMINAXCONTROL.GarminAxControl_t.1 ActiveX control in...
The domain-locking implementation in the GARMINAXCONTROL.GarminAxControl_t.1 ActiveX control in npGarmin.dll in the Garmin Communicator Plug-In 2.6.4.0 does not properly enforce the restrictions that (1) download and (2) upload requests come from a web site specified by the user, which allows remote attackers to obtain sensitive information or reconfigure Garmin GPS devices via unspecified vectors related to a "synchronisation error."
Exploit likelihood
What each source reports
NVD Score used
The domain-locking implementation in the GARMINAXCONTROL.GarminAxControl_t.1 ActiveX control in npGarmin.dll in the Garmin Communicator Plug-In 2.6.4.0 does not properly enforce the restrictions that (1) download and (2) upload requests come from a web site specified by the user, which allows remote attackers to obtain sensitive information or reconfigure Garmin GPS devices via unspecified vectors related to a "synchronisation error."
- Record
CVE-2009-0194- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The domain-locking implementation in the GARMINAXCONTROL.GarminAxControl_t.1 ActiveX control in npGarmin.dll in the Garmin Communicator Plug-In 2.6.4.0 does not properly enforce the restrictions that (1) download and (2) upload requests come from a web site specified by the user, which allows remote attackers to obtain sensitive information or reconfigure Garmin GPS devices via unspecified vectors related to a "synchronisation error."
- Record
CVE-2009-0194- Updated
- 2026-11-02
EUVDEUVD-2009-0203 No score
The domain-locking implementation in the GARMINAXCONTROL.GarminAxControl_t.1 ActiveX control in npGarmin.dll in the Garmin Communicator Plug-In 2.6.4.0 does not properly enforce the restrictions that (1) download and (2) upload requests come from a web site specified by the user, which allows remote attackers to obtain sensitive information or reconfigure Garmin GPS devices via unspecified vectors related to a "synchronisation error."
- Record
EUVD-2009-0203- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hcqc-5qwx-9gqm No score
The domain-locking implementation in the GARMINAXCONTROL.GarminAxControl_t.1 ActiveX control in...
The domain-locking implementation in the GARMINAXCONTROL.GarminAxControl_t.1 ActiveX control in npGarmin.dll in the Garmin Communicator Plug-In 2.6.4.0 does not properly enforce the restrictions that (1) download and (2) upload requests come from a web site specified by the user, which allows remote attackers to obtain sensitive information or reconfigure Garmin GPS devices via unspecified vectors related to a "synchronisation error."
- Record
GHSA-hcqc-5qwx-9gqm- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-0194 is a high vulnerability (CVSS 9.3) in Garmin Communicator Plugin, published May 11, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.25%, the 83rd percentile. No source names a fixed version.
References
exchange.xforce.ibmcloud.com/vulnerabilities/50360
secunia.com/secunia_research/2009-16
securitytracker.com/id?1022173
securityfocus.com/archive/1/503319/100/0/threaded
osvdb.org/54258
nvd.nist.gov/vuln/detail/CVE-2009-0194
github.com/advisories/GHSA-hcqc-5qwx-9gqm