CVE-2007-3679

critical

Description

The Citrix EPA ActiveX control (aka the "endpoint checking control" or CCAOControl Object) before 4.5.0.0 in npCtxCAO.dll in Citrix Access Gateway Standard Edition before 4.5.5 and Advanced Edition before 4.5 HF1 allows remote attackers to download and execute arbitrary programs onto a client system.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/35511

http://www.vupen.com/english/advisories/2007/2583

http://www.symantec.com/content/en/us/enterprise/research/SYMSA-2007-006.txt

http://www.securityfocus.com/bid/24975

http://www.securityfocus.com/bid/24865

http://www.securityfocus.com/archive/1/474204/100/0/threaded

http://support.citrix.com/article/CTX114028

http://support.citrix.com/article/CTX113815

http://securityreason.com/securityalert/2916

http://secunia.com/advisories/26143

http://osvdb.org/37845

Details

Source: Mitre, NVD

Published: 2007-07-25

Updated: 2026-06-16

Risk Information

CVSS v2

Base Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.00926