CVE-2015-0925
The client in iPass Open Mobile before 2.4.5 on Windows allows remote authenticated users to...
The client in iPass Open Mobile before 2.4.5 on Windows allows remote authenticated users to execute arbitrary code via a DLL pathname in a crafted Unicode string that is improperly handled by a subprocess reached through a named pipe, as demonstrated by a UNC share pathname.
Exploit likelihood
What each source reports
NVD Score used
The client in iPass Open Mobile before 2.4.5 on Windows allows remote authenticated users to execute arbitrary code via a DLL pathname in a crafted Unicode string that is improperly handled by a subprocess reached through a named pipe, as demonstrated by a UNC share pathname.
- Record
CVE-2015-0925- CVSS 2.0
- 9.0 High
AV:N/AC:L/Au:S/C:C/I:C/A:C - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE List No score
The client in iPass Open Mobile before 2.4.5 on Windows allows remote authenticated users to execute arbitrary code via a DLL pathname in a crafted Unicode string that is improperly handled by a subprocess reached through a named pipe, as demonstrated by a UNC share pathname.
- Record
CVE-2015-0925- Updated
- 2026-11-02
EUVDEUVD-2015-0933 No score
The client in iPass Open Mobile before 2.4.5 on Windows allows remote authenticated users to execute arbitrary code via a DLL pathname in a crafted Unicode string that is improperly handled by a subprocess reached through a named pipe, as demonstrated by a UNC share pathname.
- Record
EUVD-2015-0933- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-447v-97c3-8w6x No score
The client in iPass Open Mobile before 2.4.5 on Windows allows remote authenticated users to...
The client in iPass Open Mobile before 2.4.5 on Windows allows remote authenticated users to execute arbitrary code via a DLL pathname in a crafted Unicode string that is improperly handled by a subprocess reached through a named pipe, as demonstrated by a UNC share pathname.
- Record
GHSA-447v-97c3-8w6x- Weakness
- CWE-94
- Updated
- 2026-11-02
OSVCLSA-2026-1774657370 No score
TuxCare security update for jsonwebtoken (2 CVEs)
TuxCare rebuilt jsonwebtoken to address 2 CVEs. Fixed in 0.4.0-tuxcare.1.
- Record
CLSA-2026-1774657370- Updated
- 2026-11-02
OSVROOT-APP-NPM-NSWG-ECO-17 No score
NSWG-ECO-17 in jsonwebtoken - Patched by Root
Root has patched NSWG-ECO-17 in the jsonwebtoken package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-NSWG-ECO-17- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
jsonwebtokenTuxCare:npm |
0.4.0-tuxcare.0 up to 0.4.0-tuxcare.1, plus listed versions 0.4.0 |
0.4.0-tuxcare.1 |
jsonwebtokenRoot:npm |
before 0.1.0-aikido.3 | 0.1.0-aikido.30.4.0-aikido.30.1.0-aikido.50.1.0-aikido.40.4.0-aikido.4 |
@rootio/jsonwebtokenRoot:npm |
before 0.1.0-root.io.2 | 0.1.0-root.io.20.4.0-root.io.20.1.0-root.io.30.4.0-root.io.30.1.0-root.io.50.1.0-root.io.40.4.0-root.io.4 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | IPass Control Pipe - Remote Command Execution (Metasploit) | 2015-03-16 |
| Metasploit | iPass Mobile Client Service Privilege Escalation | 2015-03-12 |
| Metasploit | IPass Control Pipe Remote Command Execution | 2015-01-21 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-0925 is a high vulnerability (CVSS 9.0) in Ipass Open Mobile, published January 22, 2015. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 52.2%, the 98th percentile. Fixed in jsonwebtoken 0.4.0-tuxcare.1.