CVE-2011-10028

20.08.2025, 16:15

The RealNetworks RealArcade platform includes an ActiveX control (InstallerDlg.dll, version 2.6.0.445) that exposes a method named Exec via the StubbyUtil.ProcessMgr COM object. This method allows remote attackers to execute arbitrary commands on a victim's Windows machine without proper validation or restrictions. This platform was sometimes referred to or otherwise known as RealArcade or Arcade Games and has since consolidated with RealNetworks' platform, GameHouse.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	UNKNOWN				---
VulnCheck	CNA	---				---
CISA-ADP	ADP	---				---

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 47%

Common Weakness Enumeration

CWE-623 - Unsafe ActiveX Control Marked Safe For Scripting
An ActiveX control is intended for restricted use, but it has been marked as safe-for-scripting.

References

https://advisories.checkpoint.com/defense/advisories/public/2011/cpai-2011-347.html

https://archive.org/details/com.real.arcade

https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/browser/real_arcade_installerdlg.rb

https://www.exploit-db.com/exploits/17105

https://www.exploit-db.com/exploits/17149

https://www.gamehouse.com/

https://www.vulncheck.com/advisories/real-networks-arcade-games-activex-arbitrary-code-execution

https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/browser/real_arcade_installerdlg.rb

https://www.exploit-db.com/exploits/17105

https://www.exploit-db.com/exploits/17149