CVE-2013-10064

published 2025-08-05

CVE-2013-10064: A stack-based buffer overflow vulnerability exists in ActFax Server version 5.01. The server's RAW protocol interface fails to safely process user-supplied…

Priority P2 72 critical 9.3 CVSS 4.0

AV N AC L AT N PR N UI N VC H VI H VA H SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

EXPLOIT

A stack-based buffer overflow vulnerability exists in ActFax Server version 5.01. The server's RAW protocol interface fails to safely process user-supplied data in @F506 fax header fields due to insecure usage of strcpy. Remote attackers can exploit this vulnerability by sending specially crafted @F506 fields, potentially leading to arbitrary code execution. Successful exploitation requires network access to TCP port 4559 and does not require authentication.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
actfax_communication	actfax_server	—	—

Detection & IOCs extracted from sources · hover to see the quote

port 4559/TCP↗

command @F506↗

version ActFax Server 5.01↗

• → Monitor TCP port 4559 for unauthenticated connections sending RAW fax protocol data containing oversized @F506 fields, which indicates exploitation of the strcpy-based stack buffer overflow. ↗
• → No authentication is required to trigger the vulnerability; any unauthenticated connection to TCP/4559 submitting @F506 data fields should be treated as suspicious. ↗
• → The Metasploit module targets Windows XP SP3 (English); correlate ActFax 5.01 process crashes or unexpected code execution on Windows XP hosts listening on TCP/4559 as a high-confidence exploitation indicator. ↗

• · The RAW protocol interface is the attack surface; if the ActFax RAW Server feature is disabled or TCP/4559 is firewalled, the attack vector is eliminated. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-121