CVE-2008-5297

Buffer overflow in No-IP DUC 2.1.7 and earlier allows remote HTTP servers to execute arbitrary...

7.6 HighPublic exploitFix available

Buffer overflow in No-IP DUC 2.1.7 and earlier allows remote HTTP servers to execute arbitrary code via a crafted response to a DNS update request, related to a missing length check in the GetNextLine function.

Exploit likelihood

18.5%Down 5.6 points since Feb 4, 2022

What each source reports

NVD Score used 7.6

Record: CVE-2008-5297
CVSS 2.0: 7.6 HighAV:N/AC:H/Au:N/C:C/I:C/A:C
Weakness: CWE-119
Updated: 2026-11-02

CVE List No score

Record: CVE-2008-5297
Updated: 2026-11-02

EUVDEUVD-2008-5274 No score

Record: EUVD-2008-5274
Updated: 2026-11-03

GitHub AdvisoriesGHSA-f38c-5cp7-qg7j No score

Buffer overflow in No-IP DUC 2.1.7 and earlier allows remote HTTP servers to execute arbitrary...

Record: GHSA-f38c-5cp7-qg7j
Weakness: CWE-119
Updated: 2026-11-02

Affected products

vitalwerks no-ip duc

Affected packages

Affected packages
Package	Affected	Fixed
`no-ip` Debian:4.0	before 2.1.1-4+etch1, plus listed versions 2.1.1-4	2.1.1-4+etch1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	No-IP DUC 2.1.7 - Remote Code Execution	2008-11-18

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2008-5297 is a high vulnerability (CVSS 7.6) in Vitalwerks No-ip Duc, published December 1, 2008. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 18.5%, the 97th percentile. Fixed in no-ip 2.1.1-4+etch1.

References

Show 10 moreShow less