CVE-2019-16278

Nostromo nhttpd Directory Traversal Vulnerability

Nostromo nhttpd

CVSS

9.8Critical

ExploitationExploited in the wildAdded to KEV 7 Nov 2024CISA KEV

Exploit odds (EPSS)99.0%Chance of exploitation activity in the next 30 days, higher than 99.9% of CVEs. Scored 23 Oct 2026FIRST EPSS

Fixed inNone listedNo source names a fixed version yet

Federal deadline28 Nov 2024Remediation due date for US federal agenciesCISA KEV

CISA required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. CISA KEV

What fixes it

No source in this snapshot names a fixed version.

Timeline

14 Oct 2019, 16:06 UTCPublishedCVE List
20 Oct 2019Exploit code publicMetasploit
7 Nov 2024Added to CISA KEVCISA KEV

Public exploit code and templates 4

Exploit moduleNostromo Directory Traversal Remote Command Execution 20 Oct 2019Metasploit
Remote exploitNostromo - Directory Traversal Remote Command Execution (Metasploit) 1 Nov 2019Exploit-DB
Remote exploitnostromo 1.9.6 - Remote Code Execution 1 Jan 2020Exploit-DB
Scanner templatenostromo 1.9.6 - Remote Code ExecutionNuclei

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

Nostromo nhttpd contains a directory traversal vulnerability in the http_verify() function in a non-chrooted nhttpd server allowing for remote code execution.

Text from CVE List

Affected versions 1

n/aaffected: n/aCVE List