Vulnerability record · CVE-2012-4177 · published 7 August 2012
CVE-2012-4177: Ubisoft Uplay PC browser plugin command injection via -orbit_exe_path
Ubi · Uplay Pc
The web browser plugin in Ubisoft Uplay PC before 2.0.4 passes the -orbit_exe_path command line argument without sanitization, allowing OS command injection. A remote attacker can cause arbitrary programs to execute on the host, and the flaw is trivially reachable from a web page because the plugin is invoked by the browser.
Description
The web browser plugin for Ubisoft Uplay PC before 2.0.4 allows remote attackers to execute arbitrary programs via the -orbit_exe_path command line argument.
AV:N/AC:L/Au:N/C:C/I:C/A:C
Automated analysis
high priorityRemote unauthenticated command execution with complete impact and public exploit code, though the affected product is an older game client and the flaw is not in KEV.
What it is
The web browser plugin in Ubisoft Uplay PC before 2.0.4 passes the -orbit_exe_path command line argument without sanitization, allowing OS command injection. A remote attacker can cause arbitrary programs to execute on the host, and the flaw is trivially reachable from a web page because the plugin is invoked by the browser.
Impact
An attacker gains arbitrary code execution with the privileges of the user running the browser and Uplay plugin, which can lead to full system compromise. The CVSS 2.0 vector rates confidentiality, integrity and availability impact as complete.
Attack surface
Reached over the network through the browser plugin; the CVSS vector AV:N/AC:L/Au:N indicates no authentication is required. User interaction is not stated in the record, but a victim would typically need to load attacker-controlled web content that invokes the plugin.
Exploitation
Not listed in CISA KEV and no ransomware associations are documented. EPSS is high (0.5802, 99th percentile) and an Exploit-DB entry (20321) is referenced, indicating public exploit code exists.
What to do
- Upgrade Uplay PC to version 2.0.4 or later, which the vendor states contains the security fix.
- If the plugin is not required, disable or remove the Uplay browser plugin to eliminate the attack path.
- Restrict or block browser invocation of the Uplay plugin via browser extension/plugin policy where feasible.
- Monitor for and block untrusted web content that attempts to launch the Uplay plugin with unusual command line arguments.
Detection
- Monitor process creation for Uplay/browser plugin processes with unexpected -orbit_exe_path values or child processes spawned from the browser.
- Alert on browser processes spawning command interpreters or executables outside expected Uplay paths.
- Review endpoint logs for Uplay plugin launches originating from untrusted or unexpected web origins.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2012-4177 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2012-4177), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
