CVE-2007-1972
** DISPUTED ** PatrolAgent.exe in BMC Performance Manager does not require authentication for...
PatrolAgent.exe in BMC Performance Manager does not require authentication for requests to modify configuration files, which allows remote attackers to execute arbitrary code via a request on TCP port 3181 for modification of the masterAgentName and masterAgentStartLine SNMP parameters. NOTE: the vendor disputes this vulnerability, stating that it does not exist when the system is properly configured
Exploit likelihood
What each source reports
NVD Score used
PatrolAgent.exe in BMC Performance Manager does not require authentication for requests to modify configuration files, which allows remote attackers to execute arbitrary code via a request on TCP port 3181 for modification of the masterAgentName and masterAgentStartLine SNMP parameters. NOTE: the vendor disputes this vulnerability, stating that it does not exist when the system is properly configured
- Record
CVE-2007-1972- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
PatrolAgent.exe in BMC Performance Manager does not require authentication for requests to modify configuration files, which allows remote attackers to execute arbitrary code via a request on TCP port 3181 for modification of the masterAgentName and masterAgentStartLine SNMP parameters. NOTE: the vendor disputes this vulnerability, stating that it does not exist when the system is properly configured
- Record
CVE-2007-1972- Updated
- 2026-11-02
EUVDEUVD-2007-1966 No score
PatrolAgent.exe in BMC Performance Manager does not require authentication for requests to modify configuration files, which allows remote attackers to execute arbitrary code via a request on TCP port 3181 for modification of the masterAgentName and masterAgentStartLine SNMP parameters. NOTE: the vendor disputes this vulnerability, stating that it does not exist when the system is properly configured
- Record
EUVD-2007-1966- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-38wr-g9xc-v3j7 No score
** DISPUTED ** PatrolAgent.exe in BMC Performance Manager does not require authentication for...
** DISPUTED ** PatrolAgent.exe in BMC Performance Manager does not require authentication for requests to modify configuration files, which allows remote attackers to execute arbitrary code via a request on TCP port 3181 for modification of the masterAgentName and masterAgentStartLine SNMP parameters. NOTE: the vendor disputes this vulnerability, stating that it does not exist when the system is properly configured.
- Record
GHSA-38wr-g9xc-v3j7- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-1972 is a high vulnerability (CVSS 7.5) in Bmc Performance Manager, published April 22, 2007. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 3.97%, the 90th percentile.
References
securityfocus.com/archive/1/466223/100/0/threaded
zerodayinitiative.com/advisories/ZDI-07-020.html
vupen.com/english/advisories/2007/1458
securitytracker.com/id?1017935
securityreason.com/securityalert/2599
nvd.nist.gov/vuln/detail/CVE-2007-1972
github.com/advisories/GHSA-38wr-g9xc-v3j7