How severe is CVE-2009-0389?

CVE-2009-0389 has a CVSS 2.0 base score of 9.3, rated critical severity.

Is CVE-2009-0389 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 9% (95th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2009-0389?

CVE-2009-0389 affects Eztools-software Web On Windows Activex. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2009-0389?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2009-0389 published?

CVE-2009-0389 was published on 2009-02-02 and last updated on 2026-06-16.

CVE-2009-0389

CVE-2009-0389 is a critical-severity vulnerability in Eztools-software Web On Windows Activex with a CVSS 2.0 base score of 9.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Critical (CVSS 2.0 base score 9.3)
EPSS exploit prediction: 9% (95th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Eztools-software Web On Windows Activex
Published: 2009-02-02
Last modified: 2026-06-16

Description

Multiple insecure method vulnerabilities in the Web On Windows (WOW) ActiveX control in WOW ActiveX 2 allow remote attackers to (1) create and overwrite arbitrary files via the WriteIniFileString method, (2) execute arbitrary programs via the ShellExecute method, (3) read from the registry via unspecified vectors, and (4) write to the registry via unspecified vectors. NOTE: vectors 1 and 2 can be used together to execute arbitrary code.

Frequently asked questions

What is CVE-2009-0389?: Multiple insecure method vulnerabilities in the Web On Windows (WOW) ActiveX control in WOW ActiveX 2 allow remote attackers to (1) create and overwrite arbitrary files via the WriteIniFileString method, (2) execute arbitrary programs via the ShellExecute method, (3) read from the registry via unspecified vectors, and (4) write to the registry via unspecified vectors. NOTE: vectors 1 and 2 can be used together to execute arbitrary code.
How severe is CVE-2009-0389?: CVE-2009-0389 has a CVSS 2.0 base score of 9.3, rated critical severity.
Is CVE-2009-0389 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 9% (95th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2009-0389?: CVE-2009-0389 affects Eztools-software Web On Windows Activex. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2009-0389?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2009-0389 published?: CVE-2009-0389 was published on 2009-02-02 and last updated on 2026-06-16.

References

Affected products (1)

cpe:2.3:a:eztools-software:web_on_windows_activex:2:*:*:*:*:*:*:*