CVE-2019-25597
MediumCVSS 6.2Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
NSauditor 3.1.2.0 contains a buffer overflow vulnerability in the SNMP Auditor Community field, allowing local attackers to crash the application by supplying an excessively long string. Attackers can paste a large payload into the Community field and trigger the Walk function to cause a denial of service condition.
Risk Assessment
A local attacker can cause the application to crash, leading to unavailability of the auditing tool and potential operational disruption.
Recommendation
Update NSauditor to the latest version if available, and restrict local access to the application.
Other vulnerabilities in NSauditor
See all- CVE-2018-25213High
Nsauditor version 3.0.28.0 contains a structured exception handling buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying malicious input to the DNS Lookup tool.
- CVE-2020-37130High
Nsauditor version 3.2.0.0 contains a denial of service vulnerability in the registration name input field that allows attackers to crash the application. Attackers can create a malicious payload of 1000 bytes of repeated characters to trigger an application crash when pasted into the registration name field.
- CVE-2021-47815High
Nsauditor version 3.2.3 contains a denial of service vulnerability in the registration code input field that allows attackers to crash the application. Attackers can paste a large buffer of 256 repeated characters into the 'Key' field to trigger an application crash.
Original NVD description (English source)
NSauditor 3.1.2.0 contains a buffer overflow vulnerability in the SNMP Auditor Community field that allows local attackers to crash the application by supplying an excessively long string. Attackers can paste a large payload into the Community field and trigger the Walk function to cause a denial of service condition.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS