Sunway Forcecontrol SNMP NetDBServer.exe Opcode 0x57

published 2025-08-30 14 mo ago modified 2026-06-16 4 mo ago also EUVD-2011-5260

cvss: 9.3; version 4.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.6%; EPSS 1.6% chance of exploitation in 30 days, percentile 76%
public exploits: 1; Metasploit

Sunway ForceControl version 6.1 SP3 and earlier contains a stack-based buffer overflow vulnerability in the SNMP NetDBServer service, which listens on TCP port 2001. The flaw is triggered when the service receives a specially crafted packet using opcode 0x57 with an overly long payload. Due to improper bounds checking during packet parsing, attacker-controlled data overwrites the Structured Exception Handler (SEH), allowing arbitrary code execution in the context of the service. This vulnerability can be exploited remotely without authentication and may lead to full system compromise on affected Windows hosts.

Timeline

2011-09-22 First public exploit (Metasploit exploit/windows/scada/sunway_force_control_netdbsrv)
2025-08-30 Published

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: total
Assessed: 14 mo ago (2025-09-02)

Exploit prediction

1.62% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

Metasploit exploit/windows/scada/sunway_force_control_netdbsrv Sunway Forcecontrol SNMP NetDBServer.exe Opcode 0x57 metasploit exploit, great rank, 2011-09-22
raw.githubusercontent.com https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/scada/sunway_force_control_netdbsrv.rb referenced PoC, tagged "exploit" by a source, unverified
exploit-db.com https://www.exploit-db.com/exploits/18448 referenced PoC, tagged "exploit" by a source, unverified
aluigi.altervista.org http://aluigi.altervista.org/adv/forcecontrol_1-adv.txt referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	9.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA	4.0	9.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

Sunway ForceControl

Classification

Weakness

CWE-121 Stack-based Buffer Overflow

References

raw.githubusercontent.com /rapid7/metasploit-framework/master/modules/exploits/windows/scada/sunway_force_control_netdbsrv.rb
exploit
exploit-db.com /exploits/18448
exploit
aluigi.altervista.org /adv/forcecontrol_1-adv.txt
technical-description, exploit
fortiguard.com /encyclopedia/ips/29449
third-party-advisory
sunwayland.com /
product
web.archive.org /web/20110611043512/http://www.sunwayland.com.cn/pro.asp
product
vulncheck.com /advisories/sunway-forcecontrol-snmp-netdbserver-opcode
third-party-advisory

Sources

CVE List CVE-2011-10032
NVD CVE-2011-10032

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary