CVE-2002-2300

3Com NBX 4.0.17 and 4.1.4 - Denial of Service via Long CEL Command

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2002-2300. PoCs published by Michael S. Scheidell.

AI-analyzed exploit summary The exploit describes a denial of service vulnerability in the ftpd server of 3Com Superstack 3 NBX IP phones by sending an excessively long CEL parameter. The issue may also allow arbitrary code execution under certain conditions.

Description

Buffer overflow in ftpd 5.4 in 3Com NBX 4.0.17 or ftpd 5.4.2 in 3Com NBX 4.1.4 allows remote attackers to cause a denial of service (crash) via a long CEL command.

Exploits (1)

exploitdb WRITEUP VERIFIED

by Michael S. Scheidell · textdoshardware

https://www.exploit-db.com/exploits/22060

View Code ZIP pw:eip

The exploit describes a denial of service vulnerability in the ftpd server of 3Com Superstack 3 NBX IP phones by sending an excessively long CEL parameter. The issue may also allow arbitrary code execution under certain conditions.

Classification

Writeup 80%

Attack Type

Dos

Complexity

Trivial

Reliability

Theoretical

Target: 3Com Superstack 3 NBX IP phones ftpd server

No auth needed

Prerequisites: Network access to the vulnerable ftpd server

MITRE ATT&CK