Legacy Update contains an ActiveX control whose IsPermitted method fails to reject hosts that are not on an approved list. The control therefore returns success even when the page’s hostname is unauthorized. Attackers can trick a user into opening a malicious Internet Explorer page that loads the control, then use the control to read update and system information, install updates without the user's consent, display arbitrary dialogs, or restart the computer if a reboot is pending. The flaw is a clear instance of missing access control and improper handling of untrusted origins, resulting in potential full compromise of the affected system.

The vulnerability affects Legacy Update versions 1.12.0 through 1.13.1, which run on legacy Windows PCs. The issue is confined to the ActiveX component of the tool. A patch is available in Legacy Update 1.13.2 and later releases, which correct the origin validation logic.

The CVSS base score of 9.9 indicates a severe impact, but the EPSS score of less than 1% suggests that, at present, exploitation is unlikely. The flaw is not listed in CISA’s KEV catalog. Attackers gain both privileged operations – such as installing unsigned updates – and potentially reboot control, provided the victim’s browser allows ActiveX execution and the victim visits a malicious site that loads the control. Thus, the risk is high and the exploitability, while low now, remains significant if targeted.