CVE-2011-5227: Enterasys NMS Syslog service stack buffer overflow via PRIO field

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 2.0 base score of 10 with a network-reachable, pre-authentication buffer overflow in a management server, combined with a very high EPSS percentile, warrants immediate patching.

What it is

The Syslog service (nssyslogd.exe) in Enterasys Network Management Suite (NMS) before 4.1.0.80 contains a stack-based buffer overflow reachable through a long PRIO field in a message sent to UDP port 514. Because the service is network-facing and the flaw is pre-authentication, a single crafted datagram can corrupt the stack and potentially lead to remote code execution on the NMS host.

Impact

A remote, unauthenticated attacker can execute arbitrary code with the privileges of the Syslog service, which on a management suite host can mean full control of the NMS server and the network devices it manages.

Attack surface

Reached over the network by sending a UDP packet to port 514 with an oversized PRIO field; no authentication or user interaction is required per the CVSS vector AV:N/AC:L/Au:N.

Exploitation

Not listed in CISA KEV and no public exploit tag is present in the references, but EPSS is very high (0.76952, 99.5th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Upgrade Enterasys NMS to version 4.1.0.80 or later, which the vendor states fixes the issue.
• If the Syslog listener cannot be patched immediately, restrict UDP/514 access to trusted syslog sources only and block it from untrusted networks.
• Disable or stop the nssyslogd.exe service on NMS hosts that do not need to receive syslog traffic.
• Segment the NMS management network so a compromised Syslog service cannot reach managed devices or other critical assets.
• Monitor vendor advisory and Enterasys knowledge base article 14206 for updated guidance.

Detection

• Inspect syslog traffic for abnormally long PRIO fields or malformed PRIO values before the message text.
• Alert on nssyslogd.exe crashes or unexpected process termination on NMS hosts.
• Monitor for unusual outbound connections or child processes spawned by nssyslogd.exe.
• Review network flow logs for unexpected sources sending UDP/514 to NMS servers.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.