$ cve CVE-2008-5284 JSON

CVE-2008-5284 EXPLOIT

10.0

HIGH · CVSS 2.0 · EPSS 4.4% (pctl 91)

Patch early

A public exploit exists.

Description

The web server in IEA Software RadiusNT and RadiusX 5.1.38 and other versions before 5.1.44, Emerald 5.0.49 and other versions before 5.0.52, Air Marshal 2.0.4 and other versions before 2.0.8, and Radius test client (aka Radlogin) 4.0.20 and earlier, allows remote attackers to cause a denial of service (crash) via an HTTP Content-Length header with a negative value, which triggers a single byte overwrite of memory using a NULL terminator. NOTE: some of these details are obtained from third party information.

Scoring

CVSS	10.0 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:C/I:C/A:C
EPSS	4.44% — more likely to be exploited than 91% of all CVEs
Weakness	CWE-189
On CISA KEV	no
Public exploit	yes
Published	2008-11-29
Last modified	2026-06-16

Affected (6)

Vendor	Product
iea software	air marshal
iea software	emerald
iea software	radius test client
iea software	radiusnt
iea software	radiusx
iea software	radlogin

Public exploits

Source	Title	Date
exploit-db	IEA Software (Multiple Products) - POST Denial of Service	2008-02-08

References

→ the Explorer · watch your stack · NVD