CVE-2007-4149 json
The Visionsoft Audit on Demand Service (VSAOD) in Visionsoft Audit 12.4.0.0 does not require authentication for (1) the "LOG." command, whi…
published 2007-08-03 19 y ago modified 2026-06-16 4 mo ago also EUVD-2007-4133
- cvss
- 10.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 4.8%
- EPSS 4.8% chance of exploitation in 30 days, percentile 92%
- public exploits
- 0
- none known
Summary
The Visionsoft Audit on Demand Service (VSAOD) in Visionsoft Audit 12.4.0.0 does not require authentication for (1) the "LOG." command, which allows remote attackers to create or overwrite arbitrary files; (2) the SETTINGSFILE command, which allows remote attackers to overwrite the ini file, and reconfigure VSAOD or cause a denial of service; or (3) the UNINSTALL command, which allows remote attackers to cause a denial of service (daemon shutdown). NOTE: vector 1 can be leveraged for code execution by writing to a Startup folder.
Exploit prediction
4.83% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
References
-
portcullis.co.uk
/uplds/advisories/vauninstall%2006_045.txt
vendor-advisory
-
portcullis.co.uk
/uplds/advisories/vainifileoverwrite%20-%2006_041.txt
vendor-advisory
-
portcullis.co.uk
/uplds/advisories/vafileover-06-039.txt
vendor-advisory
-
securityfocus.com
/bid/25153
vdb-entry
-
osvdb.org
/42462
vdb-entry
Sources
- CVE List CVE-2007-4149
- NVD CVE-2007-4149
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.