CVE-2004-2386

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2004-12-31 · updated 2026-06-16
Weakness: CWE-134

Description

Format string vulnerability in the LogMsg function in sercd before 2.3.1 and sredird 2.2.1 and earlier allows remote attackers to execute arbitrary code via format string specifiers passed from the HandleCPCCommand function.

Affected products

Denis Sbragion Sredird: 1.0, 1.1.6, 1.1.7, 1.1.8, 2.0, 2.1 (+2)
Peter Astrand Sercd: 2.3.0

References

http://cvs.lysator.liu.se/viewcvs/viewcvs.cgi/sercd/sercd.c?root=sercd
http://secunia.com/advisories/12351
http://securitytracker.com/id?1011038
http://www.osvdb.org/8375
http://www.osvdb.org/9104
http://www.securityfocus.com/bid/11002
http://www.securityfocus.com/bid/11031
https://exchange.xforce.ibmcloud.com/vulnerabilities/17056
http://cvs.lysator.liu.se/viewcvs/viewcvs.cgi/sercd/sercd.c?root=sercd
http://secunia.com/advisories/12351
http://securitytracker.com/id?1011038
http://www.osvdb.org/8375

Get alerted when CVE-2004-2386 or the next vulnerability affects your stack