CVE-2007-6377: BadBlue ext.dll PassThru stack buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote unauthenticated code execution with public exploit code and very high EPSS, though the product is legacy and no longer vendor-supported.

What it is

BadBlue 2.72b and earlier contains a stack-based buffer overflow in the PassThru functionality of ext.dll, triggered by a long query string. A remote, unauthenticated attacker can send a crafted request to overwrite stack memory and potentially execute arbitrary code on the server.

Impact

Successful exploitation allows remote code execution in the context of the BadBlue web server process, giving the attacker control of the host. Even without code execution, the overflow can crash the service, causing denial of service.

Attack surface

The flaw is reached over the network through the PassThru functionality in ext.dll via an HTTP query string. Per the CVSS vector AV:N/AC:L/Au:N, no authentication and no user interaction are required.

Exploitation

CISA KEV does not list this CVE, but public proof-of-concept and exploit references exist and EPSS is very high (0.664, 99th percentile), indicating elevated likelihood of exploitation attempts.

What to do

• Upgrade or replace BadBlue 2.72b and earlier; the vendor no longer maintains the product, so migrate to a supported web server.
• If BadBlue must remain, restrict network access to the service with firewall rules and place it behind a reverse proxy that filters oversized query strings.
• Disable or remove the ext.dll PassThru functionality if it is not required.
• Run the BadBlue service under a low-privilege account to limit the impact of code execution.

Detection

• Monitor web server logs for unusually long or malformed query strings targeting ext.dll or PassThru paths.
• Alert on BadBlue process crashes or restarts that correlate with inbound HTTP requests.
• Use network IDS signatures for known BadBlue overflow exploit patterns and monitor for shellcode-like payloads in query strings.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.