CVE-2005-2597 AOL Client Software 9.0 uses insecure permissions for its installation path, which allows local users to execute arbitrary code with SYSTEM privileges by replacing ACSD.exe with a malicious program.

HighCVSS 7.2 EPSS 0.39%

Published: 2005-08-17 07:00
Updated: 2026-06-17 01:15
Exploit status: No public exploit known

Description

AOL Client Software 9.0 uses insecure permissions for its installation path, which allows local users to execute arbitrary code with SYSTEM privileges by replacing ACSD.exe with a malicious program.

Affected products

Product	Affected versions	Fixed in
aol client software	= 9.0	No fix listed

References

20050807 Eh? Oh well....Flaws in AOL software, and accountability. Patch available for one of the two. mailing-list
14530 vdb-entry
aol-subfolder-weak-security(24324) vdb-entry

CVSS v2.0

7.2 High

AV:L/AC:L/Au:N/C:C/I:C/A:C

Access Vector: Local
Access Complexity: Low
Authentication: None
Confidentiality: Complete
Integrity: Complete
Availability: Complete

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.39% (percentile 33.1)
CWE: Not classified

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.