CVE-2007-3009: Format string vulnerability in the MprLogToFile::logEvent function in Mbedthis AppWeb 2.0.5-4, when the bui...

Security readout for executives and security teams

CVE-2007-3009 is a denial-of-service flaw in Mbedthis AppWeb 2.0.5-4. A remote request using malformed scheme text can crash the daemon when logging support is built in but logging is disabled in configuration. The source bundle does not provide CVSS, a vendor-fixed version, or evidence of active exploitation. Exposure is likely limited to legacy Mbedthis AppWeb 2.0.5-4 deployments with the specific logging build/configuration combination. Internet-facing embedded, appliance, or old web-management services should be checked first. The bundle’s affected product fields are incomplete. Treat this as a targeted legacy-service availability risk. It is not documented as actively exploited in the bundle, but internet-facing affected services could be crashed remotely. Prioritize discovery and containment over emergency response unless the service supports critical operations. Mitigation focus: Inventory AppWeb instances and confirm exact version and build options.; Check vendor or maintainer guidance for fixed versions or supported replacements.; Restrict external access to affected AppWeb services until remediation is confirmed..

Prepared

Jun 29, 2026, 05:15 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.