CVE-2009-1064: Orbit Downloader

Medium severity, CVSS 5.8. EPSS: 3.7% chance of exploitation in the next 30 days.

Argument injection vulnerability in orbitmxt.dll 2.1.0.2 in the Orbit Downloader 2.8.7 and earlier ActiveX control allows remote attackers to overwrite arbitrary files via whitespace and a command-line switch, followed by a full pathname, in the third argument to the download method.

Affected products

• Orbit Downloader Orbit Downloader: version 2.6.3 only; version 2.6.4 only
• Orbitdownloader Orbit Downloader: up to and including 2.8.7; version 2.6.1 only; version 2.6.3 only; version 2.6.4 only; version 2.6.5 only; version 2.7.1 only; …

Published 2009-03-26. Last modified 2026-06-16.