Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2007-5762

CWE-20 — Improper Input Validation4 documents4 sources
Severity
7.2HIGH
EPSS
0.5%
top 35.05%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Novell Netware Client
Timeline
PublishedJan 9
Latest updateMay 1

Description

NICM.SYS driver 3.0.0.4, as used in Novell NetWare Client 4.91 SP4, allows local users to execute arbitrary code by opening the \\.\nicm device and providing crafted kernel addresses via IOCTLs with the METHOD_NEITHER buffering mode.

CVSS vector

AV:L/AC:L/C:C/I:C/A:CExploitability: 3.9 | Impact: 10.0

Affected Packages1 packages

Patches

Patch: download.novell.com ↗Patch: labs.idefense.com ↗Patch: www.securityfocus.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-jvm6-98cw-prpg: NICM↗2022-05-01
▶
CVEList
CVE-2007-5762: NICM↗2008-01-09
▶

💥Exploits & PoCs

1
Exploit-DB
Novell Client 4.91 SP4 - Local Privilege Escalation↗2012-05-22
▶
CVE-2007-5762 (HIGH CVSS 7.2) | NICM.SYS driver 3.0.0.4 | cvebase.io