$ cve CVE-2008-1357 JSON

CVE-2008-1357 EXPLOIT

5.4

MEDIUM · CVSS 2.0 · EPSS 6.2% (pctl 93)

Patch early

A public exploit exists.

Description

Format string vulnerability in the logDetail function of applib.dll in McAfee Common Management Agent (CMA) 3.6.0.574 (Patch 3) and earlier, as used in ePolicy Orchestrator 4.0.0 build 1015, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via format string specifiers in a sender field in an AgentWakeup request to UDP port 8082. NOTE: this issue only exists when the debug level is 8.

Scoring

CVSS	5.4 (MEDIUM, v2.0)
Vector	AV:N/AC:H/Au:N/C:N/I:N/A:C
EPSS	6.2% — more likely to be exploited than 93% of all CVEs
Weakness	CWE-134
On CISA KEV	no
Public exploit	yes
Published	2008-03-17
Last modified	2026-06-16

Affected (4)

Vendor	Product
mcafee	agent
mcafee	cma
mcafee	epolicy orchestrator
mcafee	mcafee framework

Public exploits

Source	Title	Date
exploit-db	McAfee Framework ePolicy 3.x - Orchestrator '_naimcomn_Log' Remote Format String	2008-03-12

References

→ the Explorer · watch your stack · NVD