Arm Whois 3

The issue is in Arm Whois 3.11, a Windows desktop WHOIS lookup utility sold by Armcode. The vulnerable input is the application's "IP address or domain" field; public exploit material describes oversized input around 658+ bytes causing a stack/SEH overwrite when the user pastes data into the GUI and clicks the lookup action. Publicly visible vendor pages still show 3.11 as the downloadable build, and I could not verify any newer fixed version.

The vendor-style 9.8/CRITICAL framing does not match reality for enterprise prioritization. This is not a broadly exposed server-side network service; it is a client-side Windows app that appears to require the target to have the software installed, open it, and process attacker-controlled input locally. That attacker-position friction, plus the product's niche footprint and lack of in-the-wild evidence, pushes this down hard.

Why this verdict

• Attacker position is worse than the CVSS says: the supplied AV:N/UI:N story does not fit the public exploit behavior; this looks like a user-driven desktop exploit path.
• Exposure population is tiny: Arm Whois is a special-purpose Windows utility, not a mainstream enterprise platform or server daemon, so the reachable installed base is small.
• Blast radius starts at one user session: even if exploitation succeeds, the immediate outcome is code execution as the logged-in user, not domain-wide or appliance-level compromise.
• No exploitation pressure signal: not KEV-listed, no campaign reporting, and the supplied EPSS 0.00255 all argue against urgent fleet-wide treatment.
• Modern controls add friction: EDR exploit prevention, application control, and basic user-awareness controls can disrupt delivery or post-execution behavior.

Why not higher?

Because the chain appears to require local or user-assisted processing in a client application, this is not a perimeter-breaker and not a wormable event. Public exploit code exists, but public exploit code for a niche GUI app on old Windows builds does not automatically translate into high enterprise urgency.

Why not lower?

I am not calling it IGNORE because there is still a plausible code-execution path on any endpoint where the software is present and used. If you do have this tool installed in analyst or admin workstations, it is a legitimate cleanup target and should be removed or controlled.

1. Inventory the product — Find every host with arm-whois.exe or installed Arm Whois components so you know whether this CVE is even real in your environment. For a LOW verdict there is no SLA (treat as backlog hygiene), but do the inventory in the next normal software-hygiene cycle so you can scope exposure accurately.
2. Retire or uninstall it where possible — If the utility is not business-critical, remove it rather than waiting for a patch that may not exist. For a LOW verdict there is no SLA (treat as backlog hygiene); fold removal into your next workstation cleanup or tooling rationalization wave.
3. Restrict execution — Where the app must remain, use AppLocker, WDAC, or equivalent allowlisting to limit who can run it and from where. For a LOW verdict there is no SLA (treat as backlog hygiene), but this is a sensible control for admin/analyst workstations that tend to attract post-phish tooling.
4. Monitor for exploit-like child processes — Create EDR detections for arm-whois.exe spawning shells, scripting engines, or unusual network clients, because successful exploitation should produce very visible follow-on behavior. For a LOW verdict there is no SLA (treat as backlog hygiene); add it when you next tune workstation exploit telemetry.

Run this on the target Windows endpoint or through your endpoint management tooling with standard read access; admin is helpful for broad filesystem coverage but not strictly required. Example: powershell.exe -ExecutionPolicy Bypass -File .\check-armwhois.ps1 from an elevated shell or RMM job. The script reports VULNERABLE if it finds Arm Whois 3.11, PATCHED if the product is absent, and UNKNOWN if it finds a different version because no public fixed version is verified.

# check-armwhois.ps1

# Detect Arm Whois 3.11 presence on Windows.

# Exit codes:

#   0 = PATCHED / not installed

#   1 = VULNERABLE

#   2 = UNKNOWN


$ErrorActionPreference = 'SilentlyContinue'

function Write-Result {
    param(
        [string]$Status,
        [string]$Message,
        [int]$Code
    )
    Write-Output "$Status - $Message"
    exit $Code
}

$candidates = @()

# Common install paths

$paths = @(
    "$env:ProgramFiles\Arm Whois\arm-whois.exe",
    "$env:ProgramFiles(x86)\Arm Whois\arm-whois.exe",
    "$env:ProgramFiles\Armcode\Arm Whois\arm-whois.exe",
    "$env:ProgramFiles(x86)\Armcode\Arm Whois\arm-whois.exe"
)

foreach ($p in $paths) {
    if (Test-Path $p) { $candidates += $p }
}

# Uninstall registry search

$uninstallRoots = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
)

$regHits = foreach ($root in $uninstallRoots) {
    Get-ItemProperty $root | Where-Object {
        $_.DisplayName -match 'Arm Whois'
    }
}

foreach ($hit in $regHits) {
    if ($hit.DisplayIcon -and (Test-Path ($hit.DisplayIcon -replace ',0$',''))) {
        $candidates += ($hit.DisplayIcon -replace ',0$','')
    }
    if ($hit.InstallLocation) {
        $exe = Join-Path $hit.InstallLocation 'arm-whois.exe'
        if (Test-Path $exe) { $candidates += $exe }
    }
}

$candidates = $candidates | Sort-Object -Unique

if (-not $candidates -or $candidates.Count -eq 0) {
    Write-Result 'PATCHED' 'Arm Whois not found on this host (software absent).' 0
}

foreach ($exe in $candidates) {
    $item = Get-Item $exe
    if (-not $item) { continue }

    $version = $item.VersionInfo.ProductVersion
    if (-not $version) { $version = $item.VersionInfo.FileVersion }
    if (-not $version) { $version = 'UNKNOWN' }

    if ($version -match '^3\.11(\.|$)?') {
        Write-Result 'VULNERABLE' "Found Arm Whois version $version at $exe" 1
    }
}

# If we found the product but not version 3.11, we cannot verify a fixed release publicly.

$foundList = ($candidates -join '; ')
Write-Result 'UNKNOWN' "Arm Whois found, but not version 3.11. Public fixed-version data is not verified. Paths: $foundList" 2

Sources

1. Armcode product page for Arm Whois
2. Armcode download page showing Arm Whois 3.11
3. VulDB entry for CVE-2018-25427
4. Vulmon exploit details for EDB-45796
5. Vulners search results for Arm Whois exploit entries
6. NVD entry for related Arm Whois local RCE variant CVE-2018-25432
7. OpenCVE entry for related Arm Whois local DoS variant CVE-2018-25423
8. CISA Known Exploited Vulnerabilities Catalog