CVE-2015-2077

CVE-2015-2077 is a medium-severity vulnerability in Komodia Redirector Sdk with a CVSS 2.0 base score of 5.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-200.

Key facts

• Severity: Medium (CVSS 2.0 base score 5.0)
• EPSS exploit prediction: 3% (85th percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-200
• Affected product: Komodia Redirector Sdk
• Published: 2015-02-24
• Last modified: 2026-06-17

Description

The SDK for Komodia Redirector with SSL Digestor, as used in Lavasoft Ad-Aware Web Companion 1.1.885.1766 and Ad-Aware AdBlocker (alpha) 1.3.69.1, Qustodio for Windows, Atom Security, Inc. StaffCop 5.8, and other products, uses the same X.509 certificate private key for a root CA certificate across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging knowledge of this key, as originally reported for Superfish VisualDiscovery on certain Lenovo Notebook laptop products.

Frequently asked questions

What is CVE-2015-2077?

The SDK for Komodia Redirector with SSL Digestor, as used in Lavasoft Ad-Aware Web Companion 1.1.885.1766 and Ad-Aware AdBlocker (alpha) 1.3.69.1, Qustodio for Windows, Atom Security, Inc. StaffCop 5.8, and other products, uses the same X.509 certificate private key for a root CA certificate across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging knowledge of this key, as originally reported for Superfish VisualDiscovery on certain Lenovo Notebook laptop products.

How severe is CVE-2015-2077?

CVE-2015-2077 has a CVSS 2.0 base score of 5.0, rated medium severity.

Is CVE-2015-2077 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 3% (85th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2015-2077?

CVE-2015-2077 affects Komodia Redirector Sdk. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2015-2077?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2015-2077 published?

CVE-2015-2077 was published on 2015-02-24 and last updated on 2026-06-17.

References

• http://blog.erratasec.com/2015/02/extracting-superfish-certificate.html#.VOq6Yfn8Fp4
• http://blog.erratasec.com/2015/02/some-notes-on-superfish.html#.VOq6Yvn8Fp4
• http://marcrogers.org/2015/02/19/lenovo-installs-adware-on-customer-laptops-and-compromises-all-ssl/
• http://news.lenovo.com/article_display.cfm?article_id=1929
• http://support.lenovo.com/us/en/product_security/superfish
• http://www.kb.cert.org/vuls/id/529496
• http://www.securityfocus.com/bid/72693
• http://www.securitytracker.com/id/1031779
• http://www.theguardian.com/technology/2015/feb/19/lenovo-accused-compromising-user-security-installing-adware-pcs-superfish
• http://www.us-cert.gov/cas/techalerts/TA15-051A.html
• http://www.wired.com/2015/02/lenovo-superfish/
• https://blog.filippo.io/komodia-superfish-ssl-validation-is-broken/
• https://www.facebook.com/notes/protect-the-graph/windows-ssl-interception-gone-wild/1570074729899339

Affected products (1)

• cpe:2.3:a:komodia:redirector_sdk:-:*:*:*:*:*:*:*

More vulnerabilities in Komodia Redirector Sdk

• CVE-2015-2078 — Medium (CVSS 5.0): The SDK for Komodia Redirector with SSL Digestor, as used in Lavasoft Ad-Aware Web Companion 1.1.885.1766 and Ad-Aware…

All CVEs affecting Komodia Redirector Sdk →

Other CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) vulnerabilities

• CVE-2026-27604 — Critical (CVSS 10.0): FOSSBilling is a free, open-source billing and client management system. Starting in version 0.5.4 and prior to version…
• CVE-2026-40965 — Critical (CVSS 10.0): Cloud Foundry UAA versions v76.12.0 through v78.12.0 are vulnerable to a private key exposure. The server contains a…
• CVE-2026-42826 — Critical (CVSS 10.0): Exposure of sensitive information to an unauthorized actor in Azure DevOps allows an unauthorized attacker to disclose…
• CVE-2025-29270 — Critical (CVSS 10.0): Incorrect access control in the realtime.cgi endpoint of Deep Sea Electronics devices DSE855 v1.1.0 to v1.1.26 allows…
• CVE-2025-61481 — Critical (CVSS 10.0): An issue in MikroTik RouterOS v.7.14.2 and SwOS v.2.18 exposes the WebFig management interface over cleartext HTTP by…
• CVE-2025-53624 — Critical (CVSS 10.0): The Docusaurus gists plugin adds a page to your Docusaurus instance, displaying all public gists of a GitHub user.…

Browse all CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) vulnerabilities →