High severity8.8NVD Advisory· Published Jan 21, 2009· Updated Jun 16, 2026
CVE-2009-0244
CVE-2009-0244
Description
Directory traversal vulnerability in the OBEX FTP Service in the Microsoft Bluetooth stack in Windows Mobile 6 Professional, and probably Windows Mobile 5.0 for Pocket PC and 5.0 for Pocket PC Phone Edition, allows remote authenticated users to list arbitrary directories, and create or read arbitrary files, via a .. (dot dot) in a pathname. NOTE: this can be leveraged for code execution by writing to a Startup folder.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
7cpe:2.3:o:microsoft:windows_mobile:5.0:*:*:*:*:*:*:*+ 6 more
- cpe:2.3:o:microsoft:windows_mobile:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_mobile:5.0:*:pocket_pc:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_mobile:5.0:*:smartphone:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_mobile:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_mobile:6.0:*:pro:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_mobile:6.0:*:standard:*:*:*:*:*
- (no CPE)range: 6 Professional, 5.0 for Pocket PC, 5.0 for Pocket PC Phone Edition
Patches
Vulnerability mechanics
References
6- securityreason.com/securityalert/4938nvdExploit
- www.seguridadmobile.com/windows-mobile/windows-mobile-security/Microsoft-Bluetooth-Stack-Directory-Traversal.htmlnvdBroken LinkExploit
- www.securityfocus.com/archive/1/500199/100/0/threadednvdBroken LinkThird Party AdvisoryVDB Entry
- www.securityfocus.com/bid/33359nvdBroken LinkThird Party AdvisoryVDB Entry
- exchange.xforce.ibmcloud.com/vulnerabilities/48124nvdThird Party AdvisoryVDB Entry
- secunia.com/advisories/33598nvdBroken Link
News mentions
0No linked articles in our index yet.