Analyst readout for executives and security teams
Plain-English summary
This is a legacy Novell NetWare FTP server issue. A remote user can send specially formatted input in the FTP username field and crash the FTP service or server process, causing an ABEND denial of service. The source bundle does not provide CVSS, confirmed fixes, or modern exploitation evidence.
Executive priority
Prioritize if legacy NetWare FTP remains operational or externally reachable. The business risk is service disruption, not confirmed data theft, based on the provided sources. If no such systems exist, record the CVE as not applicable after validation.
Technical view
CVE-2002-0930 is a format string vulnerability in NWFTPD for Novell NetWare 6.0 SP1. The reported attack vector is the FTP USER command, resulting in denial of service through an ABEND. The provided data names NetWare 6.0 SP1 and NWFTPD, but lacks CPEs, CWE mapping, patch details, and CVSS scoring.
Likely exposure
Exposure is most likely limited to organizations still running Novell NetWare 6.0 SP1 with the NWFTPD FTP service enabled, especially if reachable from untrusted networks. The source bundle does not identify other affected versions or products.
Exploitation context
Public vulnerability references existed in 2002, including VulnWatch, Bugtraq, SecurityFocus, and ISS entries. The provided bundle does not show CISA KEV listing or current active exploitation evidence. Treat this as a known public denial-of-service issue against legacy infrastructure.
Researcher notes
Evidence is sparse and old. The bundle supports a remote format string denial of service through FTP USER against NWFTPD on NetWare 6.0 SP1. It does not support claims about code execution, authenticated requirements, affected later versions, available patches, or active exploitation.
Mitigation direction
- Inventory for Novell NetWare 6.0 SP1 systems running NWFTPD.
- Disable NWFTPD where FTP is not business-critical.
- Restrict FTP access to trusted networks only.
- Check archived Novell/vendor guidance for patches or supported upgrade paths.
- Monitor legacy NetWare hosts for FTP-related ABEND events.
Validation and detection
- Confirm whether any NetWare 6.0 SP1 assets remain in production.
- Verify whether NWFTPD is enabled on those systems.
- Check whether TCP FTP access is exposed to untrusted networks.
- Review system logs for FTP-triggered ABEND or service crashes.
- Document compensating controls if patch status cannot be verified.
Public sources used
Based on public source material and reviewed before publication.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2002-0930 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- 20020625 [VulnWatch] cqure.net.20020521.netware_nwftpd_fmtstrCVE reference · mailing-list, x_refsource_VULNWATCH
- netware-ftp-username-dos(9429)CVE reference · vdb-entry, x_refsource_XF
- 5099CVE reference · vdb-entry, x_refsource_BID
- 20020625 cqure.net.20020521.netware_nwftpd_fmtstrCVE reference · mailing-list, x_refsource_BUGTRAQ
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.