{"api_version":"1","generated_at":"2026-07-23T05:45:13+00:00","cve":"CVE-2007-2375","urls":{"html":"https://cve.report/CVE-2007-2375","api":"https://cve.report/api/cve/CVE-2007-2375.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2007-2375","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2007-2375"},"summary":{"title":"CVE-2007-2375","description":"The agent remote upgrade interface in Symantec Enterprise Security Manager (ESM) before 20070405 does not verify the authenticity of upgrades, which allows remote attackers to execute arbitrary code via software that implements the agent upgrade protocol.","state":"PUBLISHED","assigner":"mitre","published_at":"2007-04-30 23:19:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"10","severity":"","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"}}],"references":[{"url":"http://www.vupen.com/english/advisories/2007/1277","name":"http://www.vupen.com/english/advisories/2007/1277","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.symantec.com/avcenter/security/Content/2007.04.05d.html","name":"http://www.symantec.com/avcenter/security/Content/2007.04.05d.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Symantec Enterprise Security Manager Remote Upgrade Authentication Bypass","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"http://secunia.com/advisories/24767","name":"http://secunia.com/advisories/24767","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"Symantec Enterprise Security Manager Remote Upgrade Missing Authentication - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id?1017881","name":"http://www.securitytracker.com/id?1017881","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Symantec Enterprise Security Manager Upgrade Interface Lets Remote Users Execute Arbitrary Code - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/23287","name":"http://www.securityfocus.com/bid/23287","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Symantec Enterprise Security Manager Remote Upgrade Remote Code Execution Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-2375","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-2375","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2007","cve_id":"2375","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"symantec","cpe5":"enterprise_security_manager","cpe6":"5.5.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2007","cve_id":"2375","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"symantec","cpe5":"enterprise_security_manager","cpe6":"6.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2007","cve_id":"2375","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"symantec","cpe5":"enterprise_security_manager","cpe6":"6.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2007","cve_id":"2375","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"symantec","cpe5":"enterprise_security_manager","cpe6":"6.5.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2007","cve_id":"2375","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"symantec","cpe5":"enterprise_security_manager","cpe6":"6.5.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T13:33:28.623Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"23287","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/23287"},{"name":"1017881","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id?1017881"},{"name":"ADV-2007-1277","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2007/1277"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.symantec.com/avcenter/security/Content/2007.04.05d.html"},{"name":"24767","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/24767"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2007-04-05T00:00:00.000Z","descriptions":[{"lang":"en","value":"The agent remote upgrade interface in Symantec Enterprise Security Manager (ESM) before 20070405 does not verify the authenticity of upgrades, which allows remote attackers to execute arbitrary code via software that implements the agent upgrade protocol."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2007-05-22T09:00:00.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"23287","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/23287"},{"name":"1017881","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id?1017881"},{"name":"ADV-2007-1277","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2007/1277"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.symantec.com/avcenter/security/Content/2007.04.05d.html"},{"name":"24767","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/24767"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2007-2375","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The agent remote upgrade interface in Symantec Enterprise Security Manager (ESM) before 20070405 does not verify the authenticity of upgrades, which allows remote attackers to execute arbitrary code via software that implements the agent upgrade protocol."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"23287","refsource":"BID","url":"http://www.securityfocus.com/bid/23287"},{"name":"1017881","refsource":"SECTRACK","url":"http://www.securitytracker.com/id?1017881"},{"name":"ADV-2007-1277","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2007/1277"},{"name":"http://www.symantec.com/avcenter/security/Content/2007.04.05d.html","refsource":"CONFIRM","url":"http://www.symantec.com/avcenter/security/Content/2007.04.05d.html"},{"name":"24767","refsource":"SECUNIA","url":"http://secunia.com/advisories/24767"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2007-2375","datePublished":"2007-04-30T23:00:00.000Z","dateReserved":"2007-04-30T00:00:00.000Z","dateUpdated":"2024-08-07T13:33:28.623Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2007-04-30 23:19:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":10,"acInsufInfo":false,"obtainAllPrivilege":true,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:symantec:enterprise_security_manager:5.5.3:*:*:*:*:*:*:*","matchCriteriaId":"2D54B02D-2EEC-4057-9DC9-4D34DFCBB8FA"},{"vulnerable":true,"criteria":"cpe:2.3:a:symantec:enterprise_security_manager:6.0:*:*:*:*:*:*:*","matchCriteriaId":"D7D3219F-1AC4-4ED6-ACE0-CB33A104F484"},{"vulnerable":true,"criteria":"cpe:2.3:a:symantec:enterprise_security_manager:6.5:*:*:*:*:*:*:*","matchCriteriaId":"5296D33B-5F71-4DE3-B5CD-9328F091CEA9"},{"vulnerable":true,"criteria":"cpe:2.3:a:symantec:enterprise_security_manager:6.5.1:*:*:*:*:*:*:*","matchCriteriaId":"8D5C43D9-37D5-4981-87EF-BE7FAB2D1531"},{"vulnerable":true,"criteria":"cpe:2.3:a:symantec:enterprise_security_manager:6.5.2:*:*:*:*:*:*:*","matchCriteriaId":"9BC1C6DE-0C86-4A16-A432-3AB93AC1A754"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2007","CveId":"2375","Ordinal":"1","Title":"CVE-2007-2375","CVE":"CVE-2007-2375","Year":"2007"},"notes":[{"CveYear":"2007","CveId":"2375","Ordinal":"1","NoteData":"The agent remote upgrade interface in Symantec Enterprise Security Manager (ESM) before 20070405 does not verify the authenticity of upgrades, which allows remote attackers to execute arbitrary code via software that implements the agent upgrade protocol.","Type":"Description","Title":"CVE-2007-2375"},{"CveYear":"2007","CveId":"2375","Ordinal":"2","NoteData":"2007-04-30","Type":"Other","Title":"Published"},{"CveYear":"2007","CveId":"2375","Ordinal":"3","NoteData":"2007-05-22","Type":"Other","Title":"Modified"}]}}}