CVE-2004-0574 describes a critical remote code execution vulnerability within the Network News Transfer Protocol (NNTP) component of various Microsoft Windows and Exchange Server versions. This flaw, likely stemming from improper length validation and an unchecked buffer, allows attackers to execute arbitrary code via specially crafted XPAT patterns, leading to heap-based buffer overflows. With a CVSS score of 10.0, it poses a severe risk, enabling complete compromise of affected systems without authentication. While not listed in CISA's KEV catalog, a denial-of-service exploit exists in ExploitDB, and its high EPSS score indicates a significant likelihood of exploitation, despite limited public discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2000CPE matchmatch criteria | cpe:2.3:a:microsoft:exchange_server:2000:-:*:*:*:*:*:* | ||
2003CPE matchmatch criteria | cpe:2.3:a:microsoft:exchange_server:2003:-:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:o:microsoft:windows_2000:-:-:*:*:*:*:*:* | ||
4.0CPE matchmatch criteria | cpe:2.3:o:microsoft:windows_nt:4.0:*:*:*:server:*:*:* | ||
r2CPE matchmatch criteria | cpe:2.3:o:microsoft:windows_server_2003:r2:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:L/Au:N/C:C/I:C/A:C
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.