CVE-2009-20005

published 2025-09-16

CVE-2009-20005: A stack-based buffer overflow exists in the UtilConfigHome.csp endpoint of InterSystems Caché 2009.1. The vulnerability is triggered by sending a specially…

Priority P2 70 critical 9.3 CVSS 4.0

AV N AC L AT N PR N UI N VC H VI H VA H SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

EXPLOIT

A stack-based buffer overflow exists in the UtilConfigHome.csp endpoint of InterSystems Caché 2009.1. The vulnerability is triggered by sending a specially crafted HTTP GET request containing an oversized argument to the .csp handler. Due to insufficient bounds checking, the input overflows a stack buffer, allowing an attacker to overwrite control structures and execute arbitrary code. It is unknown if this vulnerability was patched and an affected version range remains undefined.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
intersystems_corporation	intersystems_cach	<= 2009.1	—

Detection & IOCs extracted from sources · hover to see the quote

url /csp/sys/UtilConfigHome.csp↗

command GET /csp/sys/UtilConfigHome.csp?[oversized_argument]↗

• → Monitor HTTP GET requests to the UtilConfigHome.csp endpoint for abnormally large argument/query string values, which may indicate a stack buffer overflow exploitation attempt. ↗
• → A Metasploit module exists for this vulnerability targeting Windows HTTP services of InterSystems Cache 2009.1; presence of this module's traffic patterns (e.g., large GET requests to UtilConfigHome.csp) should be flagged. ↗

• · Patch status is unknown; no confirmed fixed version or affected version range has been established, making version-based detection unreliable. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-121