CVE-2002-0002

CVE-2002-0002 describes a critical format string vulnerability in stunnel versions prior to 3.22, specifically when operating in client mode for SMTP, POP, or NNTP. This flaw allows remote malicious servers to execute arbitrary code on affected systems, including those running Engarde Linux, Mandrakesoft, and Red Hat. With a CVSS score of 7.5 (HIGH), this vulnerability is easily exploitable over the network with low attack complexity and no authentication required, potentially leading to complete compromise of confidentiality, integrity, and availability. Its FAUCET Risk Score of 97/100 further emphasizes its severe nature. While not listed on the KEV catalog, an exploit for this vulnerability (EDB-21192) is publicly available on ExploitDB, indicating a clear path for exploitation. The CVE has also garnered significant community discussion, with 10 mentions, suggesting ongoing awareness and potential for exploitation.