What’s Vulnerable › Vulnerabilities

CVE-2004-1391

• Severity: medium (CVSS 4.6 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2004-12-31 · updated 2026-06-16

Description

Untrusted execution path vulnerability in the PPPoE daemon (PPPoEd) in QNX RTP 6.1 allows local users to execute arbitrary programs by modifying the PATH environment variable to point to a malicious mount program.

Affected products

• Qnx Rtos: 6.1.0, 6.1.0a, 6.2.0, 6.2.1a, 6.2.1b, 6.3.0
• Qnx Rtp: 6.1

References

• http://archives.neohapsis.com/archives/fulldisclosure/2004-09/0155.html
• http://www.kb.cert.org/vuls/id/577566
• http://www.osvdb.org/9661
• http://www.rfdslabs.com.br/qnx-advs-01-2004.txt
• http://www.securityfocus.com/bid/11105
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17284
• http://archives.neohapsis.com/archives/fulldisclosure/2004-09/0155.html
• http://www.kb.cert.org/vuls/id/577566
• http://www.osvdb.org/9661
• http://www.rfdslabs.com.br/qnx-advs-01-2004.txt
• http://www.securityfocus.com/bid/11105
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17284

Get alerted when CVE-2004-1391 or the next vulnerability affects your stack