The SaveData method in the Cygnicon.ViewControl.1 ActiveX control in CyViewer.ocx in Ashampoo 3D CAD Professional 3.x before 3.0.2 allows remote attackers to write to arbitrary files via a pathname in the first argument.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Ashampoo_3d_cad_professional_3 | Ashampoo_gmbh_&_co. | 3.0 (including) | 3.0 (including) |
| Ashampoo_3d_cad_professional_3 | Ashampoo_gmbh_&_co. | 3.0.1 (including) | 3.0.1 (including) |