CVE-2009-4025
Argument injection vulnerability in the traceroute function in Traceroute.php in the...
CVE-2009-4025 is a high vulnerability (CVSS 10.0) in Pear, published November 28, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.15%, the 93rd percentile. No source names a fixed version.
- Severity
- 10.0 HighCVSS 2.0, NVD
- Exploit chance
- 6.15%EPSS, 93rd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
Argument injection vulnerability in the traceroute function in Traceroute.php in the Net_Traceroute package before 0.21.2 for PEAR allows remote attackers to execute arbitrary shell commands via the host parameter. NOTE: some of these details are obtained from third party information.
Exploit likelihood
Affected products
What each source reports
NVD Score used
Argument injection vulnerability in the traceroute function in Traceroute.php in the Net_Traceroute package before 0.21.2 for PEAR allows remote attackers to execute arbitrary shell commands via the host parameter. NOTE: some of these details are obtained from third party information.
- Record
CVE-2009-4025- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-78
- Updated
- 2026-11-02
CVE ListNo score
Argument injection vulnerability in the traceroute function in Traceroute.php in the Net_Traceroute package before 0.21.2 for PEAR allows remote attackers to execute arbitrary shell commands via the host parameter. NOTE: some of these details are obtained from third party information.
- Record
CVE-2009-4025- Updated
- 2026-11-02
EUVDEUVD-2009-3996No score
Argument injection vulnerability in the traceroute function in Traceroute.php in the Net_Traceroute package before 0.21.2 for PEAR allows remote attackers to execute arbitrary shell commands via the host parameter. NOTE: some of these details are obtained from third party information.
- Record
EUVD-2009-3996- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-54vq-c3mg-r28rNo score
Argument injection vulnerability in the traceroute function in Traceroute.php in the...
Argument injection vulnerability in the traceroute function in Traceroute.php in the Net_Traceroute package before 0.21.2 for PEAR allows remote attackers to execute arbitrary shell commands via the host parameter. NOTE: some of these details are obtained from third party information.
- Record
GHSA-54vq-c3mg-r28r- Weakness
- CWE-78
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
pear.php.net/advisory20091114-01.txt
redhat.com/archives/fedora-package-announce/2009-November/msg00998.html
security.gentoo.org/glsa/glsa-200911-06.xml
openwall.com/lists/oss-security/2009/11/23/8
Show 10 moreShow less
secunia.com/advisories/37497
securityfocus.com/bid/37094
blog.pear.php.net/2009/11/14/net_traceroute-and-net_ping-security-advisory
vupen.com/english/advisories/2009/3321
exchange.xforce.ibmcloud.com/vulnerabilities/54391
osvdb.org/60515
nvd.nist.gov/vuln/detail/CVE-2009-4025
github.com/advisories/GHSA-54vq-c3mg-r28r