Security readout for executives and security teams
Plain-English summary
This vulnerability affects a legacy Kofax e-Transactions Sender Sendbox ActiveX component. If the vulnerable control is present and reachable by untrusted content, a remote attacker could cause it to write files to attacker-chosen paths. The sources do not provide CVSS, patch status, or evidence of active exploitation.
Executive priority
Prioritize this if legacy Kofax Sendbox or ActiveX-dependent workflows still exist. The business concern is unauthorized file modification on user systems, but urgency should be based on confirmed deployment because the sources provide no CVSS score, patch details, or active exploitation evidence.
Technical view
CVE-2011-5294 is an arbitrary file write in the SaveMessage method of LEADeMail.LEADSmtp.20 in LTCML14n.dll 14.0.0.34, shipped with Kofax e-Transactions Sender Sendbox 2.5.0.933. The issue is triggered through a pathname supplied to the method’s first argument. Available sources do not describe authentication requirements, mitigations, or fixed versions.
Likely exposure
Exposure is likely limited to Windows environments where Kofax e-Transactions Sender Sendbox 2.5.0.933 or the LEADeMail.LEADSmtp.20 ActiveX control remains installed and enabled. This is most relevant for legacy desktop, browser, or line-of-business workflows that still allow ActiveX controls.
Exploitation context
The CVE description says remote attackers can write arbitrary files, but the source bundle does not cite known exploitation, public weaponization, or CISA KEV listing. Treat exploit status as unconfirmed. Risk depends heavily on whether the ActiveX control can be invoked by untrusted content in the environment.
Researcher notes
The public data is sparse: affected component, version, method, and impact are identified, but attack preconditions, fixed builds, and exploit prevalence are not. Validate exposure through software inventory and ActiveX registration state before assigning enterprise-wide risk.
Mitigation direction
- Check Kofax or successor vendor guidance for fixed versions or retirement advice.
- Remove the affected Kofax component where it is no longer required.
- Disable or block the vulnerable ActiveX control if business workflows permit.
- Restrict ActiveX execution to trusted, managed sites only.
- Monitor for unexpected file writes by browser or Kofax-related processes.
Validation and detection
- Inventory endpoints for Kofax e-Transactions Sender Sendbox 2.5.0.933.
- Search managed hosts for LTCML14n.dll version 14.0.0.34.
- Confirm whether LEADeMail.LEADSmtp.20 is registered and enabled.
- Review browser and endpoint policies controlling ActiveX execution.
- Check security logs for unusual file creation from related processes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2011-5294 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.htbridge.com/advisory/HTB23016CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.