CVE-2004-2086: Sambar Server results.stm stack buffer overflow via HTTP POST

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityRemote, unauthenticated buffer overflow with public exploit references and a very high EPSS score, though the CVSS 2.0 impact is limited to partial availability.

What it is

Sambar Server before the 6.0 production release contains a stack-based buffer overflow in results.stm. A remote attacker can trigger it with an HTTP POST request carrying an overly long query parameter, crashing the server and possibly achieving code execution. The record gives no affected version list beyond the pre-6.0 statement.

Impact

An unauthenticated attacker can crash the server, causing denial of service, and may be able to execute arbitrary code in the server's context. The CVSS 2.0 vector scores only partial availability impact, so code execution is described as possible rather than confirmed.

Attack surface

Reached over the network through an HTTP POST to results.stm with a long query parameter; the AV:N/AC:L/Au:N vector indicates no authentication and no user interaction are required. No other access precondition is stated in the record.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.75479, 99.49th percentile) and multiple references are tagged Exploit, indicating public exploit material exists. No ransomware association is documented.

What to do

• Upgrade to the Sambar Server 6.0 production release or later, which the vendor advisory identifies as the fix.
• If upgrade is not possible, restrict network access to results.stm and the server's HTTP interface to trusted sources.
• Deploy a web application firewall or reverse proxy rule to reject HTTP POST requests with abnormally long query parameters.
• Run the server with least privilege and isolate it so a crash or compromise does not affect other services.

Detection

• Monitor web server logs for POST requests to results.stm with unusually long query strings.
• Alert on repeated Sambar Server process crashes or restarts correlated with HTTP POST traffic.
• Watch for unexpected child processes or outbound connections spawned by the web server process.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.