CVE-2008-2551: Icona C6 Messenger ActiveX control allows forced download and execution of arbitrary files

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityThe flaw yields unauthenticated remote code execution with a public exploit and high EPSS score, but it is confined to an old, likely rare third-party messenger client and requires the victim to load a malicious page.

What it is

The DownloaderActiveX Control (DownloaderActiveX.ocx) shipped with Icona SpA C6 Messenger 1.0.0.1 accepts a URL in the propDownloadUrl parameter and, when propPostDownloadAction is set to "run," downloads and executes the referenced file. This lets a remote attacker turn a web page into a file-delivery and execution channel on any host running the vulnerable control, with no credentials required.

Impact

An attacker gains arbitrary code execution in the context of the logged-on user, which typically means full control of the workstation and any credentials or data reachable from it.

Attack surface

Reached over the network through a malicious or compromised web page that instantiates the ActiveX control in the victim's browser; no authentication is needed, but the victim must load the page and the control must be permitted to run, so some user interaction is implied by the AV:N/AC:M vector.

Exploitation

Not listed in CISA KEV and no ransomware association is recorded, but a public Exploit-DB entry (5732) exists and EPSS gives a 30-day probability of roughly 0.47 (98.8th percentile), indicating meaningful real-world exploitation likelihood.

What to do

• Apply the vendor fix or remove/unregister DownloaderActiveX.ocx if Icona C6 Messenger is not required; the product appears abandoned, so removal is the safer path.
• Kill or block the CLSID for DownloaderActiveX.ocx via Internet Explorer's ActiveX kill-bit mechanism and restrict ActiveX installation and execution through browser policy.
• Enforce allowlisting or blocking of outbound downloads and execution from browser processes so a downloaded payload cannot run.
• Retire or isolate hosts still running C6 Messenger 1.0.0.1, since no supported patched version is identified in this record.

Detection

• Search endpoint inventories and registry for DownloaderActiveX.ocx or its CLSID to find hosts with the control installed.
• Monitor browser and child-process telemetry for a browser spawning executables from temporary download directories.
• Alert on HTTP responses that deliver executable content to browser sessions on hosts where the control is present.
• Review proxy and DNS logs for downloads initiated by C6 Messenger or its ActiveX host process.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.