CVE-2007-3554

HP Instant Support - Driver Check < 1.5.0.3 - Remote Code Execution via HPSDDX ActiveX queryHub Function

Title source: llm

Exploitation Summary

EIP tracks 2 public exploits for CVE-2007-3554. PoCs published by shinnai, John Heasman.

AI-analyzed exploit summary This exploit targets a buffer overflow vulnerability in HP Instant Support's ActiveX control (CVE-2007-3554). It constructs a malicious payload to overwrite EIP and trigger arbitrary code execution via a crafted HTML file.

Description

Stack-based buffer overflow in the HPSDDX Class (SDD) ActiveX control in sdd.dll in HP Instant Support - Driver Check before 1.5.0.3 allows remote attackers to execute arbitrary code via a long argument to the queryHub function.

Exploits (2)

exploitdb WORKING POC VERIFIED

by shinnai · htmldoswindows

https://www.exploit-db.com/exploits/4137

View Code ZIP pw:eip

This exploit targets a buffer overflow vulnerability in HP Instant Support's ActiveX control (CVE-2007-3554). It constructs a malicious payload to overwrite EIP and trigger arbitrary code execution via a crafted HTML file.

Classification

Working Poc 90%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: HP Instant Support (ActiveX control with CLSID:156BF4B7-AE3A-4365-BD88-95A75AF8F09D)

No auth needed

Prerequisites: Victim must visit a malicious webpage or open the HTML file · ActiveX control must be installed and enabled

MITRE ATT&CK

T1203 - Exploitation for Client Execution T1189 - Drive-by Compromise

devstral-2 · analyzed Feb 16, 2026 Full analysis →

exploitdb WORKING POC VERIFIED

by John Heasman · htmlremotewindows

https://www.exploit-db.com/exploits/30257

View Code ZIP pw:eip

This exploit targets a buffer overflow vulnerability in the HP Instant Support ActiveX control. It constructs a malicious input string to overwrite memory and potentially execute arbitrary code via the 'queryHub' method.

Classification

Working Poc 90%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: HP Instant Support ActiveX control

No auth needed

Prerequisites: Victim must visit a malicious webpage or open a malicious HTML file · ActiveX control must be installed and enabled

MITRE ATT&CK

T1189 - Drive-by Compromise T1203 - Exploitation for Client Execution

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (9)

Core 9

Core References

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2007/2413

Patch, Vendor Advisory x_refsource_misc

http://www.shinnai.altervista.org/index.php?mod=02_Forum&group=Exploits&argument=Remote&topic=1183360239.ff.php&page=last

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/35228

Vendor Advisory vendor-advisory x_refsource_hp

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01077597

Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb

http://osvdb.org/37832

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/472728/100/0/threaded

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id?1018331

Patch, Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/25918

Exploit vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/24730

Scores

EPSS 0.1787

EPSS Percentile 96.8%

Details

Status published

Products (1)

hp/instant_support

Published Jul 04, 2007

Tracked Since Feb 18, 2026