Vulnerability record · CVE-2007-4983 · published 19 September 2007
CVE-2007-4983: JetAudio ActiveX control directory traversal allows arbitrary file write
Cowon America · Jetaudio
The JetAudio.Interface.1 ActiveX control in JetFlExt.dll (jetAudio 7.0.3 Basic and 7.0.3.3016) fails to sanitize the second argument to DownloadFromMusicStore, allowing a ..\ sequence to escape the intended directory. A remote attacker can therefore create or overwrite arbitrary files on the victim's machine.
Description
Directory traversal vulnerability in the JetAudio.Interface.1 ActiveX control in JetFlExt.dll in jetAudio 7.0.3 Basic and 7.0.3.3016 allows remote attackers to create or overwrite arbitrary local files via a ..\ (dot dot backslash) in the second argument to the DownloadFromMusicStore method. NOTE: some of these details are obtained from third party information. NOTE: this can be leveraged for code execution by overwriting JetAudio.exe, which is launched by the control after completion of the method call.
AV:N/AC:L/Au:N/C:C/I:C/A:C
Automated analysis
high priorityThe flaw allows remote arbitrary file write leading to code execution with a public exploit and very high EPSS, though it requires user interaction and affects an old product.
What it is
The JetAudio.Interface.1 ActiveX control in JetFlExt.dll (jetAudio 7.0.3 Basic and 7.0.3.3016) fails to sanitize the second argument to DownloadFromMusicStore, allowing a ..\ sequence to escape the intended directory. A remote attacker can therefore create or overwrite arbitrary files on the victim's machine.
Impact
An attacker can write or overwrite any file the user can access, and by overwriting JetAudio.exe, which the control launches after the method call, can achieve code execution.
Attack surface
Reached over the network through the ActiveX control, typically by luring a user to a malicious web page that instantiates it; no authentication is required, but user interaction (visiting the page and allowing the control) is needed.
Exploitation
Not listed in CISA KEV, but EPSS is 0.47261 (98.8th percentile) and a public Exploit-DB entry (4427) exists, indicating exploit code is available.
What to do
- Apply the vendor fix or upgrade to a non-vulnerable jetAudio release; if no patch exists, remove or disable the JetAudio.Interface.1 ActiveX control.
- Set the kill-bit for the vulnerable CLSID in Internet Explorer to block the control from loading.
- Restrict or disable ActiveX execution in browsers and add the relevant sites to restricted zones.
- Remove or restrict write permissions on the jetAudio installation directory so JetAudio.exe cannot be overwritten.
- Educate users not to accept or run untrusted ActiveX controls from unknown sites.
Detection
- Monitor for creation or modification of JetAudio.exe and other files in the jetAudio install path outside normal update activity.
- Alert on browser processes loading JetFlExt.dll or instantiating the JetAudio.Interface.1 control.
- Review proxy and web logs for pages hosting the ActiveX control or the Exploit-DB 4427 payload.
- Watch for unexpected file writes with ..\ patterns in paths originating from browser or ActiveX activity.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2007-4983 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2007-4983), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
