Adiscon WinSyslog 4.21 SP1 allows remote attackers to cause a denial of service (CPU consumption) via a long syslog message.

published 2003-12-31 22 y ago modified 2026-06-16 4 mo ago also EUVD-2003-1508

cvss: 7.8; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 7.2%; EPSS 7.2% chance of exploitation in 30 days, percentile 94%
public exploits: 1; Exploit-DB

Patch / fix

links 1

securityfocus.com/bid/8821 patch

Timeline

2003-10-14 First public exploit (EDB-23242)
2003-12-31 Published

Exploit prediction

7.22% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

EDB-23242 WinSyslog Interactive Syslog Server 4.21 - long Message Remote Denial of Service dos, 2003-10-14
securityfocus.com http://www.securityfocus.com/bid/8821 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	2.0	7.8	AV:N/AC:L/Au:N/C:N/I:N/A:C

Classification

Weakness

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

securityfocus.com /bid/8821
vdb-entry, exploit, patch
adiscon.com /Common/en/advisory/2003-09-15.asp
exchange.xforce.ibmcloud.com /vulnerabilities/13428
vdb-entry
securiteam.com /windowsntfocus/6L00F158KE.html

Sources

CVE List CVE-2003-1518
NVD CVE-2003-1518

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary