CVE-2008-1855

CVE-2008-1855 describes a remote denial-of-service vulnerability affecting McAfee Common Management Agent (CMA) 3.6.0.574 Patch 3 and earlier, utilized by ePolicy Orchestrator (ePO) and ProtectionPilot. Attackers can trigger a CMA Framework service crash by sending a long, invalid method within requests to the /spin//AVClient//AVClient.csp URI, leading to memory corruption. This vulnerability has a CVSS score of 5.0, indicating a medium severity. It is easily exploitable remotely with low attack complexity and no authentication required, resulting in a partial denial of service. The EPSS score is low, suggesting a low probability of exploitation in the wild. While not listed on the KEV catalog or Hot List, exploit code is publicly available on ExploitDB (EDB-5343). There is no evidence of active exploitation, and the vulnerability has received minimal community discussion or media coverage.