cbcvebase.
CVE-2010-0620
published 2010-02-25

CVE-2010-0620: Directory traversal vulnerability in the SSL Service in EMC HomeBase Server 6.2.x before 6.2.3 and 6.3.x before 6.3.2 allows remote attackers to overwrite…

PriorityP261critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
19.48%
97.0th percentile
Directory traversal vulnerability in the SSL Service in EMC HomeBase Server 6.2.x before 6.2.3 and 6.3.x before 6.3.2 allows remote attackers to overwrite arbitrary files with any content, and consequently execute arbitrary code, via a .. (dot dot) in an unspecified parameter.

Affected

2 ranges
VendorProductVersion rangeFixed in
emchomebase_server——
emchomebase_server——

Detection & IOCsextracted from sources · hover to see the quote

port18821↗
path/..\\..\\..\\..\\..\\..\\..\\..\\WINDOWS\\system32\\↗
path/..\\..\\..\\..\\..\\..\\..\\..\\WINDOWS\\system32\\wbem\\mof\\↗
commandDATA <traversal_path><filename> <length>\r\n↗
  • →Detect the EMC HomeBase SSL Service banner on TCP port 18821 to identify exposed attack surface. ↗
  • →Alert on SSL connections to TCP/18821 that send a 'DATA' command containing directory traversal sequences ('..\') in the filename parameter. ↗
  • →Monitor for unexpected file creation in WINDOWS\system32\ and WINDOWS\system32\wbem\mof\ originating from the HomeBase SSL service process, as the exploit drops an EXE and a MOF file to achieve code execution. ↗
  • →The exploit uses WMI MOF file drop (in system32\wbem\mof\) to execute the uploaded payload — monitor for new .mof files appearing in that directory as a post-exploitation indicator. ↗
  • →The exploit uses SSL on port 18821; inspect SSL traffic to/from this port for the 'DATA' command with traversal strings ('..\\') as a network-level detection opportunity. ↗
  • ·The exploit was tested only against specific Windows targets; the traversal depth (8 levels of '..') is hardcoded and assumes a fixed installation path on Windows. ↗
  • ·SSL is required (enabled by default in the module); plain-text inspection of port 18821 traffic will not capture the exploit without SSL decryption. ↗
  • ·The vulnerability affects EMC HomeBase Server 6.2.x before 6.2.3 and 6.3.x before 6.3.2; the Metasploit module specifically targets version 6.3.0. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.