CVE-2007-2375

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-04-30 · updated 2026-06-16

Description

The agent remote upgrade interface in Symantec Enterprise Security Manager (ESM) before 20070405 does not verify the authenticity of upgrades, which allows remote attackers to execute arbitrary code via software that implements the agent upgrade protocol.

Affected products

Symantec Enterprise Security Manager: 5.5.3, 6.0, 6.5, 6.5.1, 6.5.2

References

http://secunia.com/advisories/24767
http://www.securityfocus.com/bid/23287
http://www.securitytracker.com/id?1017881
http://www.symantec.com/avcenter/security/Content/2007.04.05d.html
http://www.vupen.com/english/advisories/2007/1277
http://secunia.com/advisories/24767
http://www.securityfocus.com/bid/23287
http://www.securitytracker.com/id?1017881
http://www.symantec.com/avcenter/security/Content/2007.04.05d.html
http://www.vupen.com/english/advisories/2007/1277

Get alerted when CVE-2007-2375 or the next vulnerability affects your stack