Exploitation Summary
EIP tracks 3 public exploits for CVE-2012-4598.
PoCs published by Metasploit, rgod, rgod, sinn3r, including Metasploit module exploits/windows/browser/mcafee_mvt_exec.
AI-analyzed exploit summary This Metasploit module exploits a vulnerability in McAfee Virtual Technician's MVTControl ActiveX control via the GetObject() function to load unsafe classes like WScript.Shell, enabling remote code execution under the user's context.
Description
An unspecified ActiveX control in McAfee Virtual Technician (MVT) before 6.4, and ePO-MVT, allows remote attackers to execute arbitrary code or cause a denial of service (Internet Explorer crash) via a crafted web site.
Exploits (3)
This Metasploit module exploits a vulnerability in McAfee Virtual Technician's MVTControl ActiveX control via the GetObject() function to load unsafe classes like WScript.Shell, enabling remote code execution under the user's context.
This exploit leverages a security bypass in McAfee Virtual Technician's ActiveX control (MVT.MVTControl.6300) via the GetObject() function to execute arbitrary commands (e.g., launching calc.exe) or crash the browser by specifying invalid memory addresses. The control is marked as safe for scripting, allowing remote exploitation via Internet Explorer.
This Metasploit module exploits a vulnerability in McAfee Virtual Technician's MVTControl ActiveX control by abusing the GetObject() function to load unsafe classes like WScript.Shell, leading to remote code execution under the user's context.