2X Client TuxClientSystem ActiveX InstallClient() Method Arbitrary MSI Package Installation

The version of the TuxClientSystem ActiveX control, part of the 2X Client, installed on the remote Windows host is earlier than 10.1 Build 1239. As such, its 'InstallClient' method reportedly accepts a URL to an MSI package and allows installation of an application without explicit user approval...