Microsoft Windows Mobile vulnerabilities

9 CVEs affecting Microsoft Windows Mobile, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2009-0244, published 2009-01-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2006-6908, published 2006-12-31. High severity, CVSS 10.0. EPSS: 30.7% chance of exploitation in the next 30 days. Buffer overflow in the Bluetooth Stack COM Server in the Widcomm Bluetooth stack, as packaged as Widcomm Stack 3.x and earlier on Windows, Widcomm BTStackServer 1.4.2.10 and 1.3.2.7 on Windows,…
CVE-2009-0244, published 2009-01-21. High severity, CVSS 8.8. EPSS: 30.3% chance of exploitation in the next 30 days. Directory traversal vulnerability in the OBEX FTP Service in the Microsoft Bluetooth stack in Windows Mobile 6 Professional, and probably Windows Mobile 5.0 for Pocket PC and 5.0 for Pocket PC Phone…
CVE-2008-4295, published 2008-09-27. Medium severity, CVSS 5.4. EPSS: 30.1% chance of exploitation in the next 30 days. Microsoft Windows Mobile 6.0 on HTC Wiza 200 and HTC MDA 8125 devices does not properly handle the first attempt to establish a Bluetooth connection to a peer with a long name, which allows remote…
CVE-2007-0878, published 2007-02-12. High severity, CVSS 7.8. EPSS: 20.5% chance of exploitation in the next 30 days. Unspecified vulnerability in Microsoft Internet Explorer on Windows Mobile 5.0 allows remote attackers to cause a denial of service (loss of browser and other device functionality) via a malformed…
CVE-2007-0674, published 2007-02-03. High severity, CVSS 7.1. EPSS: 16.5% chance of exploitation in the next 30 days. Pictures and Videos on Windows Mobile 5.0 and Windows Mobile 2003 and 2003SE for Smartphones and PocketPC allows user-assisted remote attackers to cause a denial of service (device hang) via a…
CVE-2007-0685, published 2007-02-03. Low severity, CVSS 2.6. EPSS: 5.8% chance of exploitation in the next 30 days. Internet Explorer on Windows Mobile 5.0 and Windows Mobile 2003 and 2003SE for Smartphones and PocketPC allows attackers to cause a denial of service (application crash and device instability) via…
CVE-2007-5493, published 2007-10-18. Medium severity, CVSS 4.3. EPSS: 4.2% chance of exploitation in the next 30 days. The SMS handler for Windows Mobile 2005 Pocket PC Phone edition allows attackers to hide the sender field of an SMS message via a malformed WAP PUSH message that causes the PDU to be incorrectly…
CVE-2007-5460, published 2007-10-15. Medium severity, CVSS 4.6. EPSS: 2.2% chance of exploitation in the next 30 days. Microsoft ActiveSync 4.1, as used in Windows Mobile 5.0, uses weak encryption (XOR obfuscation with a fixed key) when sending the user's PIN/Password over the USB connection from the host to the…
CVE-2008-4540, published 2008-10-13. Low severity, CVSS 2.1. EPSS: 2% chance of exploitation in the next 30 days. Windows Mobile 6 on the HTC Hermes device makes WLAN passwords available to an auto-completion mechanism for the password input field, which allows physically proximate attackers to bypass password…