Stack-based buffer overflow in the HTTP Server in NetMechanica NetDecision before 4.6.1 allows remote attackers to cause a denial of servic…

published 2012-03-19 14 y ago modified 2026-06-16 4 mo ago also EUVD-2012-1483

cvss: 4.3; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 26.2%; EPSS 26.2% chance of exploitation in 30 days, percentile 98%
public exploits: 4; Metasploit, Exploit-DB

Stack-based buffer overflow in the HTTP Server in NetMechanica NetDecision before 4.6.1 allows remote attackers to cause a denial of service (application crash) via a long URL in an HTTP request. NOTE: some of these details are obtained from third party information.

Timeline

2012-02-24 First public exploit (Metasploit exploit/windows/http/netdecision_http_bof)
2012-03-19 Published

Exploit prediction

26.24% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

Metasploit auxiliary/scanner/http/netdecision_traversal NetDecision NOCVision Server Directory Traversal metasploit auxiliary, normal rank, 2012-03-07
Metasploit exploit/windows/http/netdecision_http_bof NetDecision 4.5.1 HTTP Server Buffer Overflow metasploit exploit, normal rank, 2012-02-24
EDB-18604 Netmechanica NetDecision HTTP Server 4.5.1 - Remote Buffer Overflow (Metasploit) remote, 2012-03-15
EDB-18541 Netmechanica NetDecision HTTP Server - Denial of Service dos, 2012-02-29
securityfocus.com http://www.securityfocus.com/bid/52194 referenced PoC, tagged "exploit" by a source, unverified
secpod.org http://secpod.org/advisories/SecPod_Netmechanica_NetDecision_HTTP_Server_DoS_Vuln.txt referenced PoC, tagged "exploit" by a source, unverified
securityfocus.com http://www.securityfocus.com/bid/52208 referenced PoC, tagged "exploit" by a source, unverified
secpod.org http://secpod.org/blog/?p=484 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	2.0	4.3	AV:N/AC:M/Au:N/C:N/I:N/A:P

Classification

Weakness

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

exploit-db.com /exploits/18541
exploit
securityfocus.com /bid/52194
vdb-entry, exploit
secpod.org /advisories/SecPod_Netmechanica_NetDecision_HTTP_Server_DoS_Vuln.txt
exploit
securityfocus.com /bid/52208
vdb-entry, exploit
secpod.org /blog/?p=484
exploit
secunia.com /advisories/48168
third-party-advisory, vendor-advisory
osvdb.org /79651
vdb-entry
exchange.xforce.ibmcloud.com /vulnerabilities/73528
vdb-entry
netmechanica.com /news/?news_id=26

Sources

CVE List CVE-2012-1465
NVD CVE-2012-1465

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary