CVE-2015-0925: iPass Open Mobile Windows client DLL path injection allows code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityRemote authenticated code execution with complete impact and a very high EPSS percentile, though no KEV listing or known exploit reference.

What it is

The iPass Open Mobile client for Windows before 2.4.5 mishandles a DLL pathname supplied in a crafted Unicode string, which is passed to a subprocess reached through a named pipe. A remote authenticated user can therefore cause arbitrary code to load and run on the affected host. The flaw is a code injection issue in a widely deployed enterprise connectivity client, so it matters for managed Windows endpoints.

Impact

An attacker who can authenticate and reach the named pipe gains arbitrary code execution in the context of the affected subprocess, giving full compromise of confidentiality, integrity and availability on the host.

Attack surface

The vector is network-reachable (AV:N) with low complexity and requires authentication (Au:S); no user interaction is indicated. The crafted Unicode string is delivered to a subprocess through a named pipe, as demonstrated with a UNC share pathname.

Exploitation

No CISA KEV listing and no exploit references are present; EPSS is high (0.52195, 98.9th percentile), suggesting elevated likelihood of exploitation activity despite the absence of public exploit tagging.

What to do

• Upgrade iPass Open Mobile on Windows to version 2.4.5 or later, which is the fixed release named in the advisory.
• Restrict named pipe access and limit which accounts can reach the client's IPC endpoints.
• Block or tightly control outbound SMB/UNC access from endpoints so remote DLL paths cannot be resolved.
• Apply application control or DLL search-order hardening to prevent loading libraries from untrusted paths.
• Audit and remove unnecessary local accounts that could authenticate to the client service.

Detection

• Monitor process creation for the iPass client subprocess loading DLLs from UNC or non-standard paths.
• Alert on named pipe connections to iPass-related pipes from unexpected or remote accounts.
• Review Windows event logs for suspicious authentication followed by child process execution under the iPass client.
• Hunt for SMB connections from managed endpoints to untrusted hosts around the time of iPass client activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.