CVE-2010-1908
The SdcUser.TgConCtl ActiveX control in tgctlcm.dll in Consona Live Assistance, Dynamic Agent,...
CVE-2010-1908 is a high vulnerability (CVSS 9.3) in Consona Dynamic Agent, published May 11, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.34%, the 83rd percentile. No source names a fixed version.
- Severity
- 9.3 HighCVSS 2.0, NVD
- Exploit chance
- 2.34%EPSS, 83rd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
The SdcUser.TgConCtl ActiveX control in tgctlcm.dll in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance does not properly restrict access to the HTTPDownloadFile, HTTPGetFile, Install, and RunCmd methods, which allows remote attackers to execute arbitrary programs via a URL in the url argument to (1) HTTPDownloadFile or (2) HTTPGetFile.
Exploit likelihood
What each source reports
NVD Score used
The SdcUser.TgConCtl ActiveX control in tgctlcm.dll in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance does not properly restrict access to the HTTPDownloadFile, HTTPGetFile, Install, and RunCmd methods, which allows remote attackers to execute arbitrary programs via a URL in the url argument to (1) HTTPDownloadFile or (2) HTTPGetFile.
- Record
CVE-2010-1908- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE ListNo score
The SdcUser.TgConCtl ActiveX control in tgctlcm.dll in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance does not properly restrict access to the HTTPDownloadFile, HTTPGetFile, Install, and RunCmd methods, which allows remote attackers to execute arbitrary programs via a URL in the url argument to (1) HTTPDownloadFile or (2) HTTPGetFile.
- Record
CVE-2010-1908- Updated
- 2026-11-02
EUVDEUVD-2010-1927No score
The SdcUser.TgConCtl ActiveX control in tgctlcm.dll in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance does not properly restrict access to the HTTPDownloadFile, HTTPGetFile, Install, and RunCmd methods, which allows remote attackers to execute arbitrary programs via a URL in the url argument to (1) HTTPDownloadFile or (2) HTTPGetFile.
- Record
EUVD-2010-1927- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-c5xw-x5m5-vx6wNo score
The SdcUser.TgConCtl ActiveX control in tgctlcm.dll in Consona Live Assistance, Dynamic Agent,...
The SdcUser.TgConCtl ActiveX control in tgctlcm.dll in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance does not properly restrict access to the HTTPDownloadFile, HTTPGetFile, Install, and RunCmd methods, which allows remote attackers to execute arbitrary programs via a URL in the url argument to (1) HTTPDownloadFile or (2) HTTPGetFile.
- Record
GHSA-c5xw-x5m5-vx6w- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
secunia.com/advisories/39751
kb.cert.org/vuls/id/602801
wintercore.com/en/component/content/article/7-media/18-wintercore-releases-an-advisory-for-consona-products.html
wintercore.com/downloads/rootedcon_0day.pdf
securityfocus.com/archive/1/511176/100/0/threaded
nvd.nist.gov/vuln/detail/CVE-2010-1908
github.com/advisories/GHSA-c5xw-x5m5-vx6w