CVE-2015-4674

CRITICAL 9.3CVE-2015-4674 · Published 07/08/2015 · updated 17/06/2026

In short

CVE-2015-4674 is a CRITICAL (CVSS 9.3) vulnerability affecting timedoctor (timedoctor).
Chance of exploitation in the next 30 days (EPSS): 1.2%, higher than 69.5% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
timedoctor timedoctor	`= 1.4.72.3`	No fix yet

Description

The autoupdate implementation in TimeDoctor Pro 1.4.72.3 on Windows relies on unsigned installer files that are retrieved without use of SSL, which makes it easier for man-in-the-middle attackers to execute arbitrary code via a crafted file.

References

seclists.org/fulldisclosure/2015/Jun/105 · Exploit
securityfocus.com/archive/1/535881/100/700/threaded
securityfocus.com/bid/75572

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free