← Vulnerability feed

Vulnerability record · CVE-2004-1391 · published 31 December 2004

CVE-2004-1391: Qnx rtos vulnerability

Qnx · Rtos

Untrusted execution path vulnerability in the PPPoE daemon (PPPoEd) in QNX RTP 6.1 allows local users to execute arbitrary programs by modifying the PATH environment variable to point to a malicious mount program.

4.6 CVSS 2.0 Medium EPSS 0.56% · top 55.5%
4.6CVSS 2.0 base score
0.56%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
12References, 4 tagged exploit
16 Jun 2026Last modified by NVD

Description

Untrusted execution path vulnerability in the PPPoE daemon (PPPoEd) in QNX RTP 6.1 allows local users to execute arbitrary programs by modifying the PATH environment variable to point to a malicious mount program.

AV:L/AC:L/Au:N/C:P/I:P/A:P

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://archives.neohapsis.com/archives/fulldisclosure/2004-09/0155.html Exploit
http://www.kb.cert.org/vuls/id/577566 Third Party AdvisoryUS Government Resource
http://www.osvdb.org/9661
http://www.rfdslabs.com.br/qnx-advs-01-2004.txt
http://www.securityfocus.com/bid/11105 Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/17284
http://archives.neohapsis.com/archives/fulldisclosure/2004-09/0155.html Exploit
http://www.kb.cert.org/vuls/id/577566 Third Party AdvisoryUS Government Resource
http://www.osvdb.org/9661
http://www.rfdslabs.com.br/qnx-advs-01-2004.txt
http://www.securityfocus.com/bid/11105 Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/17284

Track CVE-2004-1391 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2004-1390Qnx rtos vulnerabilityMultiple buffer overflows in the PPPoE daemon (PPPoEd) in QNX RTP 6.1 allow remote attackers to execute arbitrary code via a long argument to the (1)…EPSS 7.3%10.0CVE-2004-1682Qnx rtp vulnerabilityFormat string vulnerability in QNX 6.1 FTP client allows remote authenticated users to gain group bin privileges via format string specifiers in the …EPSS 2.5%7.5CVE-2001-0325Qnx rtp vulnerabilityBuffer overflow in QNX RTP 5.60 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a large number of ar…EPSS 2.1%7.2CVE-2006-0621Qnx rtos vulnerabilityMultiple buffer overflows in QNX Neutrino RTOS 6.2.0 allow local users to execute arbitrary code via a long first argument to the (1) su or (2) passw…EPSS 0.50%7.2CVE-2006-0623Qnx rtos vulnerabilityQNX Neutrino RTOS 6.3.0 ships /etc/rc.d/rc.local with world-writable permissions, which allows local users to modify the file and execute arbitrary c…EPSS 0.91%7.2CVE-2005-1528Qnx rtos vulnerabilityUntrusted search path vulnerability in the crttrap command in QNX Neutrino RTOS 6.2.1 allows local users to load arbitrary libraries via a LD_LIBRARY…EPSS 0.84%7.2CVE-2004-1681Qnx photon microgui vulnerabilityMultiple buffer overflows in (1) phrelay-cfg, (2) phlocale, (3) pkg-installer, or (4) input-cfg in QNX Photon microGUI for QNX RTP 6.1 allow local us…EPSS 1.1%7.2CVE-2002-2040Qnx rtos vulnerabilityThe (1) phrafx and (2) phgrafx-startup programs in QNX realtime operating system (RTOS) 4.25 and 6.1.0 do not properly drop privileges before executi…EPSS 1.1%

Source: NIST National Vulnerability Database (record CVE-2004-1391), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.