Vulnerability record · CVE-2004-1388 · published 31 December 2004
CVE-2004-1388: BerliOS gpsd gpsd_report format string allows remote code execution
BBerlios · Gps Daemon
The gpsd_report function in BerliOS GPS daemon (gpsd, formerly pygps) versions 1.9.0 through 2.7 passes attacker-controlled GPS request data into syslog format strings without proper handling. A remote attacker can supply format string specifiers to corrupt memory and potentially execute arbitrary code. The flaw is remotely reachable and requires no authentication.
Description
Format string vulnerability in the gpsd_report function for BerliOS GPD daemon (gpsd, formerly pygps) 1.9.0 through 2.7 allows remote attackers to execute arbitrary code via certain GPS requests containing format string specifiers that are not properly handled in syslog calls.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityRemote, unauthenticated code execution with a public exploit reference and very high EPSS score, though no KEV listing and the product is a niche daemon.
What it is
The gpsd_report function in BerliOS GPS daemon (gpsd, formerly pygps) versions 1.9.0 through 2.7 passes attacker-controlled GPS request data into syslog format strings without proper handling. A remote attacker can supply format string specifiers to corrupt memory and potentially execute arbitrary code. The flaw is remotely reachable and requires no authentication.
Impact
An attacker can execute arbitrary code with the privileges of the gpsd process, or at minimum crash or manipulate the daemon. This compromises the host running gpsd and any services relying on it.
Attack surface
Reached over the network via crafted GPS requests sent to the gpsd service; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.
Exploitation
No CISA KEV listing, but EPSS is 0.68195 (99.293 percentile) and a public exploit reference is tagged in the record, indicating high likelihood and known exploit material.
What to do
- Upgrade gpsd to a version after 2.7 that fixes the gpsd_report format string handling; apply the vendor patch referenced in the BerliOS announcement.
- If upgrade is not possible, restrict network access to the gpsd port to trusted hosts only.
- Run gpsd with least privilege and isolate it from sensitive systems.
- Monitor vendor and distribution advisories for backported fixes for your platform.
Detection
- Inspect gpsd logs and syslog for unusual format specifiers such as %n, %s, or %x in GPS request data.
- Monitor network traffic to the gpsd service for anomalous or malformed GPS request payloads.
- Watch for unexpected crashes or restarts of the gpsd process.
- Use host-based detection for suspicious child processes or memory corruption indicators associated with gpsd.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2004-1388 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Source: NIST National Vulnerability Database (record CVE-2004-1388), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
