CVE-2006-2407: wodSSHServer ActiveX stack buffer overflow via key exchange string

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityThe flaw is remotely exploitable without authentication, has public exploit code, and carries a very high EPSS score, though it is not in CISA KEV and affects older software.

What it is

A stack-based buffer overflow exists in the WeOnlyDo wodSSHServer ActiveX component (versions 1.2.7 and 1.3.3 DEMO), which is also embedded in FreeSSHd 1.0.9 and freeFTPd 1.0.10. A remote attacker can send an overly long key exchange algorithm string to overwrite stack memory, and the flaw matters because it is reachable over the network without authentication.

Impact

Successful exploitation allows remote code execution in the context of the affected service or process. An attacker gains the ability to run arbitrary code on the host, potentially leading to full compromise of the SSH/FTP service.

Attack surface

The flaw is reached over the network via the SSH key exchange negotiation, as reflected by the AV:N/AC:L/Au:N vector. No authentication or user interaction is required; the malicious key exchange string is processed before authentication completes.

Exploitation

CISA KEV does not list this CVE, but EPSS is very high (0.71375, 99.38th percentile) and a SecurityFocus reference is tagged Exploit, indicating public exploit code exists. No ransomware association is documented.

What to do

• Apply the vendor patch referenced in the Secunia advisory tagged Patch, or upgrade wodSSHServer, FreeSSHd and freeFTPd to fixed versions.
• If patching is not possible, restrict network access to the affected SSH/FTP services to trusted hosts only.
• Disable or remove the wodSSHServer ActiveX component where it is not required.
• Monitor vendor advisories for updated fixed versions of FreeSSHd and freeFTPd.
• Segment exposed SSH/FTP services so a compromise does not grant broad internal access.

Detection

• Inspect SSH key exchange packets for abnormally long algorithm name strings that exceed expected lengths.
• Monitor service processes for crashes or unexpected restarts indicative of a buffer overflow attempt.
• Alert on exploit traffic patterns against the affected SSH/FTP ports using network IDS signatures.
• Review host logs for unexpected child processes or code execution originating from the SSH/FTP service.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.