CVE-2002-0676 json
SoftwareUpdate for MacOS 10.1.x does not use authentication when downloading a software update, which could allow remote attackers to execu…
published 2002-07-11 24 y ago modified 2026-06-16 4 mo ago also EUVD-2002-0670
- cvss
- 7.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 4.3%
- EPSS 4.3% chance of exploitation in 30 days, percentile 91%
- public exploits
- 1
- Exploit-DB
Summary
SoftwareUpdate for MacOS 10.1.x does not use authentication when downloading a software update, which could allow remote attackers to execute arbitrary code by posing as the Apple update server via techniques such as DNS spoofing or cache poisoning, and supplying Trojan Horse updates.
Timeline
- First public exploit (EDB-21596)
- Published
Exploit prediction
4.27% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-21596 Apple Mac OSX 10.1.x - SoftwareUpdate Arbitrary Package Installation remote, 2002-07-08
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
References
-
cunap.com
/~hardingr/projects/osx/exploit.html
vendor-advisory
-
osvdb.org
/5137
vdb-entry
-
securityfocus.com
/bid/5176
vdb-entry
-
iss.net
/security_center/static/9502.php
vdb-entry
Sources
- CVE List CVE-2002-0676
- NVD CVE-2002-0676
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.