CVE-2007-5824

HIGH ⚠ Exploit

webserver.c in mt-dappd in Firefly Media Server 0.2.4 and earlier allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via a stats method action to /xml-rpc with...

Affects 1 product across 1 vendor.

CVSS 2.07.1
EPSS5.6%
Percentile93th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, no confidentiality impact, no integrity impact.
CWE Weakness Definitions
CWE-20: Improper Input Validation

Software does not validate or incorrectly validates input, allowing attackers to craft data processed in unintended ways.

Related Attack Patterns (CAPEC)
CAPEC-3 Using Leading 'Ghost' Character Sequences to Bypass Input Filters
via CWE-20
CAPEC-7 Blind SQL Injection
via CWE-20
CAPEC-8 Buffer Overflow in an API Call
via CWE-20
CAPEC-9 Buffer Overflow in Local Command-Line Utilities
via CWE-20
CAPEC-10 Buffer Overflow via Environment Variables
via CWE-20
Show all 51
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A vulnerability in Firefly Media Server 0.2.4 and earlier allows remote attackers to cause a denial of service through a NULL dereference and daemon crash via specific XML-RPC requests.

BSID: BS-2007-GLOBAL-157969-H • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2007-5824?
A vulnerability in Firefly Media Server 0.2.4 and earlier allows remote attackers to cause a denial of service through a NULL dereference and daemon crash via specific XML-RPC requests.
What is the CVSS score for CVE-2007-5824?
CVE-2007-5824 has CVSS 7.1 (High). Vector: AV:N/AC:M/Au:N/C:N/I:N/A:C. EPSS: 5.6%.
Is CVE-2007-5824 actively exploited?
Public exploit available for CVE-2007-5824. Exploitation risk elevated.
How do I remediate CVE-2007-5824?
Priority: HIGH.
What systems are affected by CVE-2007-5824?
CVE-2007-5824 affects Firefly Media Server.
Vulnerability Details
CVE IDCVE-2007-5824
BSIDBS-2007-GLOBAL-157969-H BreachSpider Global ID
CVSS VectorAV:N/AC:M/Au:N/C:N/I:N/A:C
Published2007-11-05
Last Modified2026-06-16
ICS Relevance0%
Weakness (CWE)
Improper Input Validation
SourceNVD
Official Description

webserver.c in mt-dappd in Firefly Media Server 0.2.4 and earlier allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via a stats method action to /xml-rpc with (1) an empty Authorization header line, which triggers a crash in the ws_decodepassword function; or (2) a header line without a ':' character, which triggers a crash in the ws_getheaders function.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The attack is executed by sending a stats method action to /xml-rpc with either an empty Authorization header or a header without a ':' character, which triggers a crash in the ws_decodepassword or ws_getheaders functions.

Exploitation Likelihood: MEDIUM

Affected Products
VendorProductAffected Versions
Firefly Media Server ≤ 0.2.4
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 6919 Days
CISA known-exploitedNot in KEV catalog
Public Exploit⚠ Available — Reference
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
Related CVEs affecting Firefly
CVE-2007-2456 7.5 Multiple PHP remote file inclusion vulnerabilities in FireFly 1.1.01 allow re... CVE-2007-2460 7.5 PHP remote file inclusion vulnerability in modules/admin/include/config.php i... CVE-2007-5825 7.5 Format string vulnerability in the ws_addarg function in webserver.c in mt-da... CVE-2026-82957 7.3 A vulnerability was found in hyperledger-firefly firefly up to 1.4.0. The imp... CVE-2024-37893 5.9 Firefly III is a free and open source personal finance manager. In affected v...
View all Firefly CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →