Vulnerability record · CVE-2010-4742 · published 18 February 2011
CVE-2010-4742: Moxa ActiveX SDK MediaDBPlayback.DLL stack buffer overflow
Moxa · Activex Sdk
MediaDBPlayback.DLL 2.2.0.5 in the Moxa ActiveX SDK contains a stack-based buffer overflow reachable through a long PlayFileName property value. Because the control is loaded in a browser context, a crafted page can corrupt the stack and redirect execution, making this a full remote code execution flaw.
Description
Stack-based buffer overflow in a certain ActiveX control in MediaDBPlayback.DLL 2.2.0.5 in the Moxa ActiveX SDK allows remote attackers to execute arbitrary code via a long PlayFileName property value.
AV:N/AC:L/Au:N/C:C/I:C/A:C
Automated analysis
critical priorityA remotely reachable, unauthenticated stack overflow with public exploit code and a 99th-percentile EPSS score warrants immediate remediation.
What it is
MediaDBPlayback.DLL 2.2.0.5 in the Moxa ActiveX SDK contains a stack-based buffer overflow reachable through a long PlayFileName property value. Because the control is loaded in a browser context, a crafted page can corrupt the stack and redirect execution, making this a full remote code execution flaw.
Impact
An attacker gains arbitrary code execution in the context of the process hosting the ActiveX control, typically the user's browser, with the privileges of that user. CVSS 2.0 scores it 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C), reflecting complete confidentiality, integrity and availability loss.
Attack surface
Reached over the network via the ActiveX control's PlayFileName property, per the NVD vector AV:N/AC:L/Au:N, so no authentication is required. Exploitation requires the victim to load the control, which in practice means visiting a malicious or compromised page, so some user interaction is implied even though the vector does not state it.
Exploitation
Public exploit code exists: two references are tagged Exploit, including a Metasploit module for moxa_mediadbplayback. The CVE is not listed in CISA KEV, but EPSS is 0.5637 (99.0th percentile), indicating a high likelihood of exploitation activity.
What to do
- Patch or remove the vulnerable MediaDBPlayback.DLL 2.2.0.5 ActiveX control; apply any vendor update for the Moxa ActiveX SDK.
- Disable or kill-bit the affected ActiveX control in Internet Explorer and block it from loading in other hosts.
- Restrict browsing to trusted sites and enforce allowlisting so untrusted pages cannot instantiate the control.
- Remove the Moxa ActiveX SDK from systems that do not require it.
- Monitor for and block delivery of HTML or documents that instantiate the MediaDBPlayback control.
Detection
- Search endpoints for MediaDBPlayback.DLL version 2.2.0.5 and flag any host still carrying it.
- Monitor browser and process telemetry for unexpected instantiation of the MediaDBPlayback ActiveX control, especially from external or untrusted origins.
- Alert on crashes or memory corruption in processes hosting the control, which can indicate a failed overflow attempt.
- Hunt for known Metasploit moxa_mediadbplayback payload artifacts and related network or file indicators.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2010-4742 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2010-4742), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
