CVE-2002-0525

CVE-2002-0525 describes format string vulnerabilities in INN 2.2.3 and earlier, specifically within the inews and rnews components. These flaws allow local users or malicious NNTP servers to achieve privilege escalation by injecting format string specifiers into NNTP responses. With a CVSS score of 10.0, this vulnerability is critical, indicating a network-based attack with low complexity, requiring no authentication, and leading to complete compromise of confidentiality, integrity, and availability. While not listed in CISA KEV or Hot List, and with no active Metasploit or Nuclei exploits, an ExploitDB entry (EDB-21375) confirms the existence of exploit code for multiple local format string vulnerabilities in INN versions 2.0/2.1/2.2.x. There is no significant community discussion or media coverage surrounding this older vulnerability.