CVE-2011-2386: VisiWave Site Survey report file pointer dereference code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityRemote code execution with public exploit code and very high EPSS, but it requires the victim to open a crafted file and the vendor fix is available.

What it is

VisiWave Site Survey before 2.1.9 opens .vws and .vwr report files in VisiWaveReport.exe and mishandles an invalid Type property, causing an untrusted pointer dereference. A crafted report file can therefore run arbitrary code in the context of the user who opens it.

Impact

An attacker who gets a victim to open a malicious report file gains arbitrary code execution with the victim's privileges, including full compromise of confidentiality, integrity and availability per the CVSS vector.

Attack surface

Reached remotely by delivering a malicious .vws or .vwr file that the victim opens in VisiWaveReport.exe; no authentication is required, but user interaction (opening the file) is needed, matching the AV:N/AC:M/Au:N vector.

Exploitation

Public exploit code exists (Exploit-DB 17317, SecurityFocus BID 47948, StratSec advisory), and EPSS is 0.4522 (98.7th percentile), though the CVE is not listed in CISA KEV.

What to do

• Upgrade VisiWave Site Survey to version 2.1.9 or later, which the vendor released to fix this issue.
• Block or quarantine .vws and .vwr email attachments and downloads at the gateway until all endpoints are patched.
• Train users not to open VisiWave report files from untrusted sources.
• Where the product is not needed, remove or restrict VisiWaveReport.exe via application control.

Detection

• Monitor for VisiWaveReport.exe spawning child processes such as cmd.exe, powershell.exe or script hosts.
• Alert on VisiWaveReport.exe loading or writing files outside expected report directories.
• Hunt for .vws and .vwr files arriving via email or web download and correlate with VisiWaveReport.exe execution.
• Use the public exploit (Exploit-DB 17317) to build and test detection signatures for the malformed Type property.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.