CVE-2017-20211 HIGH

CVE-2017-20211: UCanCode E-XD++ Visualization Enterprise Suite Untrusted Pointer Dereference RCE

Vendor Ucancode.net Software
Product E-XD++ Visualization Enterprise Suite
Weakness CWE-823
Published November 12, 2025
Last update November 13, 2025
View on NVD All CVEs

CVSS base score

8.6/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

UCanCode E-XD++ Visualization Enterprise Suite contains an untrusted pointer dereference vulnerability via the TKDRAWCAD.TKDrawCADCtrl.1 ActiveX control. This is because it exposes a RotateShape method that dereferences a user-supplied pointer without sufficient validation. A crafted input may cause the control to dereference an attacker-controlled pointer, enabling remote code execution in the context of the hosting process. The vulnerability requires user interaction (instantiation of the ActiveX control via a web page or a file).

Key dates

02Disclosure timeline

November 12, 2025 CVE published
November 13, 2025 Record updated