CVE-2008-4342
NuMedia Soft NMS DVD Burning SDK Activex NMSDVDX.DVDEngineX.1 ActiveX control (NMSDVDX.dll) 1.013C and earlier, as used in CDBurnerXP 4.2.1.976, BurnAware 2.1.3, Blaze Media Pro 8.02 Special Edition, and possibly other products, allows remote attackers to overwrite and create arbitrary files via calls to the EnableLog and LogMessage methods. NOTE: this issue might only be exploitable in limited environments or non-default browser settings. NOTE: some of these details are obtained from third party information. NOTE: this can be leveraged for remote code execution by accessing files using hcp:// URLs.
Key facts
- CVSS score
- 9.3 (v2.0)
- Severity
- HIGH
- CVSS vector
AV:N/AC:M/Au:N/C:C/I:C/A:C- Weakness (CWE)
- CWE-20
- EPSS score
- 17.2% (97th percentile)
- In CISA KEV
- No
- In EU EUVD
- Yes (EUVD-2008-4323)
- Published
- September 30, 2008
- NVD last modified
- June 16, 2026
- Status
- Modified
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2008-4323 in the EU Vulnerability Database. Last updated in EUVD on August 7, 2024.
View on the EU Vulnerability DatabaseAffected products
- burnaware technologies / burnaware
- burnaware technologies / burnaware
- burnaware technologies / burnaware
- impressum / cdburnerxp
- numedia soft / numedia dvd burning sdk
References
- http://retrogod.altervista.org/9sg_numedia_xpl.html(Exploit)
- http://secunia.com/advisories/31936(Vendor Advisory)
- http://secunia.com/advisories/31949(Vendor Advisory)
- http://secunia.com/advisories/31950(Vendor Advisory)
- http://secunia.com/advisories/32455(Vendor Advisory)
- http://www.securityfocus.com/archive/1/497831/100/0/threaded
- http://www.securityfocus.com/bid/31374(Exploit)
- http://www.shinnai.net/xplits/TXT_TrWE9AJA8nQpuFsnxBcq(Exploit, URL Repurposed)
- http://www.vupen.com/english/advisories/2008/2663(Vendor Advisory)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45330
- https://www.exploit-db.com/exploits/6491
Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain