CVE-2005-2482: The StateToOptions function in msfweb in Metasploit Framework 2.4 and earlier, when running with the -D opt...

Security readout for executives and security teams

This old Metasploit Framework issue affects the msfweb interface in version 2.4 and earlier. A safety mode called defanged mode could be bypassed during Exploit command processing, weakening controls meant to prevent dangerous actions. Exposure is mainly relevant to legacy security-tool installations. Likely limited to obsolete Metasploit Framework 2.4 or earlier installations using msfweb with the -D defanged-mode option. Exposure is higher if msfweb is reachable by untrusted users or networks. Treat as a legacy hygiene issue unless old Metasploit msfweb is still deployed. If present, prioritize removal, isolation, or vendor-guided upgrade because the affected control was intended to reduce dangerous exploit behavior. Mitigation focus: Inventory for Metasploit Framework 2.4 or earlier installations.; Disable msfweb if it is not required.; Restrict msfweb access to trusted administrative networks only..

Prepared

Jun 29, 2026, 18:40 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.