CVE-2007-5804 json
cfgcon in IBM AIX 5.2 and 5.3 does not properly validate the argument to the "-p" option to swcons, which allows local users in the system…
published 2007-11-05 19 y ago modified 2026-06-16 4 mo ago also EUVD-2007-5774
- cvss
- 6.9
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 23%
- public exploits
- 0
- none known
Summary
cfgcon in IBM AIX 5.2 and 5.3 does not properly validate the argument to the "-p" option to swcons, which allows local users in the system group to create or overwrite an arbitrary file, and enable world writability of this file, by using the file's name as the argument.
Patch / fix
Exploit prediction
0.31% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 6.9 | AV:L/AC:M/Au:N/C:C/I:C/A:C |
References
-
securityfocus.com
/bid/26258
vdb-entry, patch
-
www14.software.ibm.com
/webapp/set2/subscriptions/ijhifoeblist?mode=7&heading=AIX53&path=%2F200710%2FSECURITY%2F20071030%2Fdatafile10
patch
-
www-1.ibm.com
/support/docview.wss?uid=isg1IZ03055
vendor-advisory
-
www-1.ibm.com
/support/docview.wss?uid=isg1IZ03061
vendor-advisory
-
exchange.xforce.ibmcloud.com
/vulnerabilities/38154
vdb-entry
-
secunia.com
/advisories/27437
third-party-advisory
-
labs.idefense.com
/intelligence/vulnerabilities/display.php?id=611
third-party-advisory
Sources
- CVE List CVE-2007-5804
- NVD CVE-2007-5804
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.