CVE-2004-1182: Hylafax

High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days.

hfaxd in HylaFAX before 4.2.1, when installed with a "weak" hosts.hfaxd file, allows remote attackers to authenticate and bypass intended access restrictions via a crafted (1) username or (2) hostname that satisfies a regular expression that is matched against a hosts.hfaxd entry without a password.

Affected products

• Hylafax Hylafax: version 4.1.1 only; version 4.1.2 only; version 4.1.3 only; version 4.1.5 only; version 4.1.6 only; version 4.1.7 only; …

Published 2004-12-31. Last modified 2026-06-16.