CVE-2005-4734: RSA SecurID Web Agent for IIS stack buffer overflow via Redirect url parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityRemote unauthenticated code execution with public exploit code and very high EPSS, though the CVSS 2.0 base score is only 6.4 and the product is legacy.

What it is

IISWebAgentIF.dll in RSA Authentication Agent for Web (SecurID Web Agent) 5.2 and 5.3 for IIS contains a stack-based buffer overflow reachable through a long url parameter in the Redirect method. A remote, unauthenticated attacker can overwrite stack memory and execute arbitrary code in the IIS process context. The flaw affects an authentication component, so compromise of that host can undermine the authentication path it is meant to protect.

Impact

Successful exploitation gives the attacker arbitrary code execution with the privileges of the IIS worker process, allowing host compromise and potential interception or bypass of authentication traffic handled by the agent.

Attack surface

Reached over the network through the IIS web interface by sending a crafted request to the Redirect method with an oversized url parameter. The CVSS vector (AV:N/AC:L/Au:N) indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV, but public exploit code exists: references are tagged Exploit, including a Metasploit module for rsa_iiswebagent_redirect. EPSS is very high (0.55274, ~99th percentile), indicating elevated predicted exploitation activity.

What to do

• Apply the vendor fix or upgrade from the affected 5.2/5.3 releases; check RSA/SecurID download pages for the corrected build.
• If the agent cannot be patched immediately, restrict network access to the IIS instance hosting it and remove it from untrusted exposure.
• Deploy a WAF or request-filtering rule that rejects oversized or malformed url parameters to the Redirect method.
• Run the IIS application pool under a least-privilege account to limit the impact of code execution.
• Retire or isolate end-of-life SecurID Web Agent deployments that no longer receive vendor updates.

Detection

• Monitor IIS and web logs for requests to the Redirect method with abnormally long url parameter values.
• Alert on IIS worker process crashes or restarts that coincide with suspicious Redirect requests.
• Hunt for post-exploitation activity on the IIS host, such as unexpected child processes spawned by w3wp.exe or new listener sockets.
• Use network signatures for known Metasploit rsa_iiswebagent_redirect exploit traffic against the agent endpoint.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.