CVE-2004-2386 json
Format string vulnerability in the LogMsg function in sercd before 2.3.1 and sredird 2.2.1 and earlier allows remote attackers to execute a…
published 2004-12-31 21 y ago modified 2026-06-16 4 mo ago also EUVD-2004-2377
- cvss
- 7.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.2%
- EPSS 3.2% chance of exploitation in 30 days, percentile 88%
- public exploits
- 0
- none known
Summary
Format string vulnerability in the LogMsg function in sercd before 2.3.1 and sredird 2.2.1 and earlier allows remote attackers to execute arbitrary code via format string specifiers passed from the HandleCPCCommand function.
Patch / fix
- sredird Debian 14, Debian 13, Debian 12 2.2.1-1.1
debian advisories DEBIAN-CVE-2004-2386
- securityfocus.com/bid/11031 patch
- osvdb.org/8375 patch
Exploit prediction
3.21% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Classification
- Weakness
-
- CWE-134 Use of Externally-Controlled Format String
References
-
securityfocus.com
/bid/11031
vdb-entry, patch
-
osvdb.org
/8375
vdb-entry, patch
-
secunia.com
/advisories/12351
third-party-advisory, vendor-advisory
-
securitytracker.com
/id?1011038
vdb-entry
-
securityfocus.com
/bid/11002
vdb-entry
-
exchange.xforce.ibmcloud.com
/vulnerabilities/17056
vdb-entry
- cvs.lysator.liu.se /viewcvs/viewcvs.cgi/sercd/sercd.c?root=sercd
-
osvdb.org
/9104
vdb-entry
Sources
- CVE List CVE-2004-2386
- NVD CVE-2004-2386
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.