CVE-2015-0925
iPass Open Mobile < 2.4.4 - Authenticated Remote Code Execution via DLL Pathname in Unicode String
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2015-0925.
PoCs published by Metasploit, Matthias Kaiser, h0ng10, including Metasploit module exploits/windows/smb/ipass_pipe_exec.
AI-analyzed exploit summary This Metasploit module exploits CVE-2015-0925 in the IPass Client service by abusing a named pipe to force the service to load a DLL from an SMB share, achieving remote command execution.
Description
The client in iPass Open Mobile before 2.4.5 on Windows allows remote authenticated users to execute arbitrary code via a DLL pathname in a crafted Unicode string that is improperly handled by a subprocess reached through a named pipe, as demonstrated by a UNC share pathname.
Exploits (3)
This Metasploit module exploits CVE-2015-0925 in the IPass Client service by abusing a named pipe to force the service to load a DLL from an SMB share, achieving remote command execution.
This Metasploit module exploits a vulnerability in the IPass Client service by abusing a named pipe to force the service to load a DLL from an SMB share, achieving remote command execution.
This Metasploit module exploits a privilege escalation vulnerability in the iPass Mobile Client Service by interacting with the named pipe '\\.\pipe\IPEFSYSPCPIPE' to execute arbitrary commands as SYSTEM via the 'LaunchAppSysMode' command.