CVE-2008-0621

EPSS 73.4%

Vexday Risk Score

60Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 73.4%KEV nãoPoC públicaNuclei —Metasploit simPatch —

Lifecycle

04 Feb 2008Metasploit module available

06 Feb 2008Published on NVD

09 May 2010Public PoC

Weaponization speed

823 daysto first PoC

Recommendation: Plan a near-term fix — a public PoC already exists.

Buffer overflow in SAPLPD 6.28 and earlier included in SAP GUI 7.10 and SAPSprint before 1018 allows remote attackers to execute arbitrary code via long arguments to the (1) 0x01, (2) 0x02, (3) 0x03, (4) 0x04, and (5) 0x05 LPD commands.

Affected products

n/a · n/a

public PoCs found — 2

exploitdbwww.exploit-db.com/exploits/16338unverified cve_referencewww.exploit-db.com/exploits/5079unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://secunia.com/advisories/28786 http://secunia.com/advisories/28811 http://securityreason.com/securityalert/3619 https://www.exploit-db.com/exploits/5079 http://www.securityfocus.com/archive/1/487508/100/0/threaded http://www.securityfocus.com/archive/1/487575/100/0/threaded http://www.securityfocus.com/bid/27613 http://www.securitytracker.com/id?1019300 http://www.vupen.com/english/advisories/2008/0409 http://www.vupen.com/english/advisories/2008/0438