CVE-2004-0552

CVE-2004-0552 describes a vulnerability in Sophos Small Business Suite 1.00 on Windows where the antivirus product fails to properly scan files with names containing reserved MS-DOS device names (e.g., LPT1, COM1). This oversight allows malicious code to bypass detection when installed, copied, or executed, posing a significant security risk. The vulnerability has a CVSS score of 7.5, indicating high severity with network-based exploitation, low attack complexity, and potential for partial compromise of confidentiality, integrity, and availability. While not listed on the KEV catalog or Hot List, an exploit (EDB-24623) exists for Sophos Anti-Virus 3.x, and the vulnerability has a high FAUCET Risk Score of 95/100, despite minimal community discussion or media coverage.