CVE-2009-1064

CVE-2009-1064 describes an argument injection vulnerability in the Orbit Downloader ActiveX control, specifically in orbitmxt.dll version 2.1.0.2, affecting Orbit Downloader 2.8.7 and earlier. This flaw allows remote attackers to overwrite arbitrary files by manipulating the download method's third argument with whitespace and a command-line switch followed by a full pathname. The vulnerability has a CVSS score of 5.8, indicating a medium severity, and can be exploited remotely with medium attack complexity, potentially leading to partial integrity and availability impacts. Its EPSS score is low, suggesting a low likelihood of exploitation in the wild, and it is not listed in CISA's KEV catalog. While there is no evidence of active exploitation or Metasploit/Nuclei modules, an exploit demonstrating arbitrary file deletion is available on ExploitDB. The vulnerability has received minimal community discussion and media coverage, typical for a CVE of this age and impact.