CVE-2011-3175: Novell ZENworks Preboot Service stack buffer overflow via opcode 0x6c

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 2.0 score of 10.0 with network reachability, no authentication and public exploit code makes this a top remediation priority despite the absence of KEV listing.

What it is

The Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a contains a stack-based buffer overflow (CWE-119) triggered by an opcode 0x6c request. Because the service is reachable over the network without authentication, a remote attacker can corrupt memory and execute arbitrary code. The flaw carries a CVSS 2.0 base score of 10.0, reflecting full confidentiality, integrity and availability impact.

Impact

A successful exploit gives the attacker arbitrary code execution in the context of the Preboot Service, typically with system-level privileges. That allows full compromise of the ZCM host, including data theft, service disruption and use as a pivot into the managed environment.

Attack surface

The vulnerability is reached over the network through the Preboot Service listening port, as indicated by the AV:N vector. No authentication or user interaction is required (Au:N, AC:L), so any host that can reach the service can attempt the attack.

Exploitation

A public Exploit-DB entry (19958) exists, and EPSS estimates a 30-day exploitation probability of roughly 66 percent (99.2nd percentile). The CVE is not listed in CISA KEV, so no confirmed in-the-wild exploitation is recorded in that catalog.

What to do

• Apply the Novell ZENworks Configuration Management patch referenced in the vendor readme (readme_5127930) and download portal as the first action.
• If patching cannot be done immediately, restrict network access to the Preboot Service port to trusted management hosts only.
• Segment ZCM servers from general user and internet-facing networks to limit reachability of the Preboot Service.
• Monitor vendor advisories for updated builds and confirm the deployed ZCM version is not 11.1 or 11.1a.
• Where feasible, disable or firewall the Preboot Service on hosts that do not require it.

Detection

• Inspect network traffic to the Preboot Service port for requests containing opcode 0x6c, especially oversized or malformed payloads.
• Monitor ZCM Preboot Service process logs and host event logs for crashes, restarts or unexpected child processes.
• Alert on unexpected outbound connections or new processes spawned by the Preboot Service process.
• Use IDS/IPS signatures for the known Exploit-DB 19958 exploit pattern against the Preboot Service.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.