CVE-2009-4657 json
The administrator package for Xerver 4.32 does not require authentication, which allows remote attackers to alter application settings by c…
published 2010-03-03 16 y ago modified 2026-06-16 4 mo ago also EUVD-2009-4622
- cvss
- 7.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.2%
- EPSS 2.2% chance of exploitation in 30 days, percentile 82%
- public exploits
- 1
- Exploit-DB
Summary
The administrator package for Xerver 4.32 does not require authentication, which allows remote attackers to alter application settings by connecting to the application on port 32123, as demonstrated by setting the action option to wizardStep1.
Timeline
- First public exploit (EDB-9717)
- Published
Exploit prediction
2.15% chance of exploitation in the next 30 days, higher than 82% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- EDB-9717 Xerver HTTP Server 4.32 - Remote Denial of Service dos, 2009-09-18
- securityfocus.com http://www.securityfocus.com/bid/36454 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Classification
- Weakness
-
- CWE-287 Improper Authentication
References
-
exploit-db.com
/exploits/9717
exploit
-
securityfocus.com
/bid/36454
vdb-entry, exploit
Sources
- CVE List CVE-2009-4657
- NVD CVE-2009-4657
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.