← Vulnerability feed

Vulnerability record · CVE-2007-4335 · published 14 August 2007

CVE-2007-4335: Qbik wingate vulnerability

Qbik · Wingate

Format string vulnerability in the SMTP server component in Qbik WinGate 5.x and 6.x before 6.2.2 allows remote attackers to cause a denial of service (service crash) via format string specifiers in certain unexpected commands, which trigger a crash during error logging.

5.0 CVSS 2.0 Medium EPSS 2.0% · top 19.8%
5.0CVSS 2.0 base score
2.0%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
18References
16 Jun 2026Last modified by NVD

Description

Format string vulnerability in the SMTP server component in Qbik WinGate 5.x and 6.x before 6.2.2 allows remote attackers to cause a denial of service (service crash) via format string specifiers in certain unexpected commands, which trigger a crash during error logging.

AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://secunia.com/advisories/26412 PatchVendor Advisory
http://securityreason.com/securityalert/3001
http://www.harmonysecurity.com/HS-A007.html
http://www.securityfocus.com/archive/1/476011/100/0/threaded
http://www.securityfocus.com/bid/25272 Patch
http://www.securityfocus.com/bid/25303
http://www.vupen.com/english/advisories/2007/2859
http://www.wingate.com/news.php?id=50
https://exchange.xforce.ibmcloud.com/vulnerabilities/35950
http://secunia.com/advisories/26412 PatchVendor Advisory
http://securityreason.com/securityalert/3001
http://www.harmonysecurity.com/HS-A007.html
http://www.securityfocus.com/archive/1/476011/100/0/threaded
http://www.securityfocus.com/bid/25272 Patch
http://www.securityfocus.com/bid/25303
http://www.vupen.com/english/advisories/2007/2859
http://www.wingate.com/news.php?id=50
https://exchange.xforce.ibmcloud.com/vulnerabilities/35950

Track CVE-2007-4335 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2020-13866Qbik wingate incorrect permission assignment vulnerabilityWinGate v9.4.1.5998 has insecure permissions for the installation directory, which allows local users to gain privileges by replacing an executable f…EPSS 1.1%7.5CVE-2006-2926Qbik WinGate WWW Proxy Server stack buffer overflow via long URLThe WWW Proxy Server component of Qbik WinGate 6.1.1.1077 contains a stack-based buffer overflow triggered by a long URL in an HTTP request. A remote…EPSS 71%analysed7.5CVE-1999-0291Qbik wingate vulnerabilityThe WinGate proxy is installed without a password, which allows remote attackers to redirect connections without authentication.EPSS 2.1%6.5CVE-2008-3606Qbik wingate memory buffer overflow vulnerabilityHeap-based buffer overflow in the IMAP service in Qbik WinGate 6.2.2.1137 and earlier allows remote authenticated users to cause a denial of service …EPSS 4.5%5.5CVE-2006-2917Qbik wingate vulnerabilityDirectory traversal vulnerability in the IMAP server in WinGate 6.1.2.1094 and 6.1.3.1096, and possibly other versions before 6.1.4 Build 1099, allow…EPSS 1.4%5.4CVE-2009-0802Qbik wingate permissions and access controls vulnerabilityQbik WinGate, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote endpoint, which allows remote attacker…EPSS 2.4%5.0CVE-2006-4518Qbik wingate vulnerabilityQbik WinGate 6.1.4 and earlier allows remote attackers to cause a denial of service (CPU consumption) via a DNS request with a self-referencing compr…EPSS 1.8%5.0CVE-2004-0789Delegate vulnerabilityMultiple implementations of the DNS protocol, including (1) Poslib 1.0.2-1 and earlier as used by Posadis, (2) Axis Network products before firmware …EPSS 2.8%

Source: NIST National Vulnerability Database (record CVE-2007-4335), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.