CVE-2008-2551: Icona Instant Messenger

High severity, CVSS 9.3. EPSS: 46.9% chance of exploitation in the next 30 days.

The DownloaderActiveX Control (DownloaderActiveX.ocx) in Icona SpA C6 Messenger 1.0.0.1 allows remote attackers to force the download and execution of arbitrary files via a URL in the propDownloadUrl parameter with the propPostDownloadAction parameter set to "run."

Affected products

• Icona Instant Messenger: version 1.0.0.1 only

Published 2008-06-04. Last modified 2026-06-16.