cnd.c in mgetty 1.1.28 and earlier does not properly filter non-printable characters and…
Priority LOW 37Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
cnd.c in mgetty 1.1.28 and earlier does not properly filter non-printable characters and quotes, which may allow remote attackers to execute arbitrary commands via shell metacharacters in (1) caller ID or (2) caller name strings.
Why it matters now
EPSS 0.01895 79th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:gert_doering:mgetty:*:*:*:*:*:*:*:* | up to 1.1.28 | Vulnerable | Gert Doering |
- cpe:2.3:a:gert_doering:mgetty:*:*:*:*:*:*:*:* Versions up to 1.1.28 Vulnerable ·Gert Doering
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2003-0516
- 2026-10-03 Alias added: GHSA-844w-q34m-gpg4
References
—
More Gert Doering Mgetty vulnerabilities
- TI-2002-01314 Buffer overflow in cnd-program for mgetty before 1.1.29 allows remote attackers to cause… CVSS 2.0HIGH 7.5
- TI-2008-04692 faxspool in mgetty 1.1.36 allows local users to overwrite arbitrary files via a symlink… CVSS 2.0MEDIUM 6.9
- TI-2000-00689 The faxrunq and faxrunqd in the mgetty package allows local users to create or modify… CVSS 2.0LOW 2.1
- TI-2002-01315 faxspool in mgetty before 1.1.29 uses a world-writable spool directory for outgoing… CVSS 2.0LOW 2.1
- TI-2001-00141 mgetty 1.1.22 allows local users to overwrite arbitrary files via a symlink attack in some configurations. CVSS 2.0LOW 1.2
Sources
- CVE-2003-0516 · CVE Program
- CVE-2003-0516 · NVD
- FIRST EPSS
- GHSA-844w-q34m-gpg4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences