EIP-2026-103918

This is a functional remote exploit for the Half-Life StatsMe plugin (versions 2.6.16/2.6.19) that leverages a format string vulnerability to achieve remote code execution. It binds a shell to port 30464/tcp and requires the attacker to have the rcon password.