CVE-2007-5825: Firefly Media Server

High severity, CVSS 7.5. EPSS: 3.7% chance of exploitation in the next 30 days.

Format string vulnerability in the ws_addarg function in webserver.c in mt-dappd in Firefly Media Server 0.2.4 and earlier allows remote attackers to execute arbitrary code via a stats method action to /xml-rpc with format string specifiers in the (1) username or (2) password portion of base64-encoded data on the "Authorization: Basic" HTTP header line.

Affected products

• Firefly Media Server: version 0.2.4 only

Published 2007-11-05. Last modified 2026-06-16.