CVE-2009-0183: Free Download Manager Remote Control Server Stack Buffer Overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 10.0 with network-reachable, unauthenticated remote code execution and a public exploit make this an urgent fix despite the product's age.

What it is

Free Download Manager's Remote Control Server contains a stack-based buffer overflow (CWE-119) triggered by a long Authorization header in an HTTP request. The flaw affects FDM 2.5 Build 758 and 3.0 Build 844 and allows remote code execution. It matters because the service is network-reachable and the overflow is trivially triggerable with a crafted header.

Impact

A remote attacker can execute arbitrary code in the context of the FDM process, leading to full compromise of confidentiality, integrity and availability. No privileges are required on the target beyond network reachability of the Remote Control Server.

Attack surface

Reached over the network via HTTP to the FDM Remote Control Server; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are needed. Any host exposing the Remote Control Server port is directly exposed.

Exploitation

Not listed in CISA KEV, but EPSS is 0.66526 (99.2nd percentile) and a public Exploit-DB entry (7986) exists, indicating mature, likely weaponized exploit code. No ransomware association is documented.

What to do

• Upgrade Free Download Manager to a version later than 3.0 Build 844 that fixes the Remote Control Server overflow.
• If upgrade is not possible, disable the Remote Control Server feature or block its listening port at the host firewall.
• Restrict network access to the Remote Control Server to trusted management hosts only; never expose it to the internet.
• Run FDM under a low-privilege account to limit the impact of successful code execution.
• Monitor vendor advisories (Secunia 33524, 2009-3) for the fixed build and apply it promptly.

Detection

• Inspect HTTP request logs to the FDM Remote Control Server for abnormally long Authorization headers.
• Alert on crashes or restarts of the FDM process, which may indicate a failed overflow attempt.
• Monitor for unexpected child processes or outbound connections spawned by the FDM process.
• Use network IDS signatures for oversized Authorization headers targeting the FDM Remote Control Server port.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.