CVE-2017-20211 - CVE House
Back to Database
Status published High CVE-2017-20211

UCanCode E-XD++ Visualization Enterprise Suite Untrusted Pointer Dereference RCE

Vulnerability Description

UCanCode E-XD++ Visualization Enterprise Suite contains an untrusted pointer dereference vulnerability via the TKDRAWCAD.TKDrawCADCtrl.1 ActiveX control. This is because it exposes a RotateShape method that dereferences a user-supplied pointer without sufficient validation. A crafted input may cause the control to dereference an attacker-controlled pointer, enabling remote code execution in the context of the hosting process. The vulnerability requires user interaction (instantiation of the ActiveX control via a web page or a file).

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-20211

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • rgod
  • Zero Day Initiative (ZDI)

References

Affected Vendor

UCanCode.Net Software

View all reports →

Affected Software

E-XD++ Visualization Enterprise Suite
Vulnerable Versions:
0

Timeline

Official Publish: November 12th, 2025
Last Modified: November 13th, 2025
Added to House: July 20th, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-823

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.