SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2007-5825

Format string vulnerability in the ws_addarg function in webserver.c in mt-dappd in Firefly Media Server 0.2.4 and earlier allows remote attackers to execute arbitrary code via a stats method action to /xml-rpc with format string specifiers in the (1)…

HIGH 7.5EPSS 3.72%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (3.72%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Format string vulnerability in the ws_addarg function in webserver.c in mt-dappd in Firefly Media Server 0.2.4 and earlier allows remote attackers to execute arbitrary code via a stats method action to /xml-rpc with format string specifiers in the (1) username or (2) password portion of base64-encoded data on the "Authorization: Basic" HTTP header line.

CVSS 2.0
7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS
3.72% probability · 90th percentile
Public exploits
None in Exploit-DB
CISA KEV
Not listed
Weakness
CWE-134
Affected
firefly/media server
Source
cve@mitre.org
EPSS trend
0%3%5%26 October 2026: 3.72%26 October 202626 October 2026

EPSS 3.7% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.