PT-2025-31988 · Unknown · Actfax Server

Published 2025-08-05 · Updated 2025-08-05 · CVE-2013-10064

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions ActFax Server version 5.01

Description A stack-based buffer overflow exists in the server’s RAW protocol interface. The interface does not safely process user-supplied data in the @F506 fax header fields due to the insecure use of strcpy. Remote attackers can exploit this issue by sending specially crafted @F506 fields, potentially leading to arbitrary code execution. Network access to TCP port 4559 is required for successful exploitation, and authentication is not required.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2013-10064

Affected Products

Actfax Server

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2013-10064 · Security Note
• http://actfax.com · Note
• https://t.me/CVEtracker/29242 · Telegram Post
• https://exploit-db.com/exploits/24467 · Note
• https://web.archive.org/web/20130212065755/http://pwnag3.com/2013/02/actfax-raw-server-exploit.html · Note
• https://vulncheck.com/advisories/actfax-raw-server-buffer-overflow · Note
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/misc/actfax_raw_server_bof.rb · Note