CVE-2012-6530: Sysax Multi Server HTTP stack buffer overflow enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityRemote code execution with public exploit code and a high EPSS score, though exploitation requires valid credentials and a specific permission, which lowers it below critical.

What it is

Sysax Multi Server before 5.52 contains a stack-based buffer overflow that is reachable when HTTP is enabled. A remote authenticated user holding the create folder permission can trigger it with a crafted request, making it a post-authentication code execution flaw in an internet-facing file transfer service.

Impact

An attacker with a valid account and create folder rights can overflow the stack and execute arbitrary code in the server process, gaining the privileges of that service. That can lead to full compromise of the host and any data it brokers.

Attack surface

Reached over the network via the HTTP interface of Sysax Multi Server, which must be enabled. Authentication is required, and the account needs the create folder permission; no user interaction beyond sending the crafted request is described.

Exploitation

Public exploit code exists, as shown by the Exploit-DB, SecurityFocus and pwnag3 references tagged Exploit. The CVE is not in CISA KEV, but EPSS is high at roughly 0.46 probability (98.8th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Upgrade Sysax Multi Server to version 5.52 or later, which fixes the overflow.
• If HTTP is not required, disable the HTTP interface to remove the attack path.
• Restrict the create folder permission to accounts that genuinely need it and review existing grants.
• Limit network exposure of the server to trusted hosts and segment it from sensitive systems.
• Monitor vendor advisories for any further fixes affecting the same component.

Detection

• Inspect HTTP request logs for oversized or malformed requests to folder creation endpoints.
• Alert on Sysax Multi Server process crashes or restarts, which can indicate failed overflow attempts.
• Watch for unexpected child processes or outbound connections spawned by the Sysax service account.
• Correlate create folder permission use with anomalous source IPs or unusual request timing.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.