Vulnerability record · CVE-2004-1812 · published 31 December 2004
CVE-2004-1812: Unicenter TNG Agent Common Services stack buffer overflows
Broadcom · Unicenter Tng
Agent Common Services components cam.exe and awservices.exe in Unicenter TNG 2.4 contain multiple stack-based buffer overflows that can be triggered remotely. Successful exploitation allows arbitrary code execution on the affected host. The record is old and thin on technical detail, but the flaw is network-reachable and unauthenticated per the CVSS vector.
Description
Multiple stack-based buffer overflows in Agent Common Services (1) cam.exe and (2) awservices.exe in Unicenter TNG 2.4 allow remote attackers to execute arbitrary code.
AV:N/AC:L/Au:N/C:C/I:C/A:C
Automated analysis
high priorityUnauthenticated remote code execution with complete impact and high EPSS, though the product is legacy and no KEV listing or confirmed exploit is recorded.
What it is
Agent Common Services components cam.exe and awservices.exe in Unicenter TNG 2.4 contain multiple stack-based buffer overflows that can be triggered remotely. Successful exploitation allows arbitrary code execution on the affected host. The record is old and thin on technical detail, but the flaw is network-reachable and unauthenticated per the CVSS vector.
Impact
A remote attacker can execute arbitrary code with the privileges of the vulnerable service, potentially gaining full control of the host. The CVSS 2.0 vector rates confidentiality, integrity and availability impact as complete.
Attack surface
Reachable over the network via the Agent Common Services listeners on cam.exe and awservices.exe; the AV:N/AC:L/Au:N vector indicates no authentication and no user interaction are required. The exact protocol and port are not stated in the record.
Exploitation
Not listed in CISA KEV and no ransomware association is recorded, but EPSS is high at roughly 0.45 (98.7th percentile), suggesting meaningful exploitation likelihood. No public exploit code is confirmed by the supplied references.
What to do
- Apply the vendor fix referenced in the CA/Broadcom advisory (QI52764) or upgrade Unicenter TNG to a supported release.
- Restrict network access to cam.exe and awservices.exe listeners using host firewalls or segmentation so only trusted management hosts can reach them.
- Run the affected services with least privilege and isolate legacy Unicenter TNG 2.4 hosts from untrusted networks.
- If the product is end-of-life and no patch is available, plan migration or decommissioning of the affected systems.
Detection
- Monitor for crashes or restarts of cam.exe and awservices.exe, which may indicate malformed input triggering the overflow.
- Inspect network traffic to Agent Common Services ports for oversized or anomalous payloads.
- Alert on unexpected child processes or command execution spawned by cam.exe or awservices.exe.
- Review host logs for suspicious activity originating from the service accounts running these components.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2004-1812 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2004-1812), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
