CVE-2003-0220: Kerio Personal Firewall administrator authentication buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote, unauthenticated code execution with a high EPSS score and public exploit material, though the product is old and no KEV listing exists.

What it is

Kerio Personal Firewall 2.1.4 and earlier contains a buffer overflow in the administrator authentication process. A remote attacker can trigger it with a crafted handshake packet, which can lead to arbitrary code execution on the host running the firewall.

Impact

An unauthenticated remote attacker can execute arbitrary code with the privileges of the vulnerable firewall service, potentially taking full control of the affected system.

Attack surface

The flaw is reached over the network via the administrator authentication handshake; the CVSS vector (AV:N/AC:L/Au:N) indicates no authentication and no user interaction are required.

Exploitation

No CISA KEV listing and no ransomware associations are recorded, but EPSS is high (0.6909, 99.3rd percentile) and a reference is tagged Exploit, indicating public exploit material exists.

What to do

• Upgrade Kerio Personal Firewall to a version later than 2.1.4, or apply the vendor patch referenced in the advisory.
• If the product is end-of-life and cannot be patched, replace it with a supported firewall.
• Restrict network access to the firewall's administrator authentication service to trusted management hosts only.
• Monitor or block inbound traffic to the management port at the network perimeter where feasible.

Detection

• Inspect firewall and IDS logs for malformed or oversized handshake packets directed at the Kerio administrator authentication service.
• Alert on unexpected process creation or crashes of the Kerio firewall service on managed endpoints.
• Hunt for known exploit signatures or anomalous traffic patterns associated with the public exploit for this issue.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.