Vulnerability · Published Dec 9, 2025 · Assigned by VulnCheck

CVE-2021-47705CNC_Ctrl DllUnregisterServer Access Violation

High 8.7

In plain English

A high-severity out-of-bounds write in COMMAX UMS Client ActiveX Control from COMMAX Co., Ltd.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.5%top 58.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

COMMAX UMS Client ActiveX Control 1.7.0.2 contains a heap-based buffer overflow vulnerability that allows attackers to execute arbitrary code by providing excessively long string arrays through multiple functions. Attackers can exploit improper boundary validation in CNC_Ctrl.dll to cause heap corruption and potentially gain system-level access.

Affected products (as reported)

Vendor	Product	Versions
COMMAX Co., Ltd.	COMMAX UMS Client ActiveX Control	1.7.0.2

Weakness: CWE-787 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

ExploitDB-50232 exploit
Zero Science Lab Disclosure (ZSL-2021-5664) third-party-advisory
Reference technical-description
VulnCheck Advisory: CNC_Ctrl DllUnregisterServer Access Violation third-party-advisory