CVE-2007-1327

Exploitation likely. EPSS gives it a 10% chance of exploitation in the next 30 days. No fix published yet.

CVSS 2.07.8High EPSS percentile96th10% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2007-03-07Updated 2026-04-23Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check whether your organization runs silc-server (used for SILC secure chat), specifically version 1.0.2.
If you don't run SILC chat software, no action is needed.
If you do run it, confirm with your IT provider whether a patched build is available, since no official fixed version is currently documented.
In the meantime, restrict network access to the SILC server to trusted IP addresses or a VPN to reduce exposure.
Monitor the server for unexpected crashes or restarts and plan to upgrade or replace it once a fix is published.

May need vendor or contractor work

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

The SILC_SERVER_CMD_FUNC function in apps/silcd/command.c in silc-server 1.0.2 allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via a request without a cipher algorithm and an invalid HMAC algorithm.

In plain language

Written by AI from the record

This is an old bug in SILC chat server software that lets someone crash the server remotely; it's worth checking but there's no sign anyone is actively attacking it right now.

Remote unauthenticated NULL pointer dereference in silc-server 1.0.2's command handler (SILC_SERVER_CMD_FUNC), triggered by a request omitting a cipher algorithm combined with an invalid HMAC algorithm, causing daemon crash (CWE-476).

If you're affected

Chat service outage
Daemon crash from remote request
Operational disruption for connected clients

What is it

SILC is chat server software, similar to an internal messaging system for a company. This flaw is like a prank caller who can say a specific phrase that makes the whole phone switchboard shut down — anyone connected gets disconnected, but no data is stolen or accounts broken into.

Who is affected

This matters to you only if you run silc-server version 1.0.2, used for SILC-protocol encrypted chat. If you don't operate a SILC chat server, you are not affected. This is only a risk if the SILC server port is reachable from the internet.

How urgent is it

There is no confirmed exploitation in the wild and no public exploit code exists, so this is not an active emergency, but press attention to this old flaw is rising and the underlying weakness is a straightforward remote crash with no login required. Treat this as a moderate-priority item: verify exposure and plan remediation, but it does not need an emergency response tonight.

What to do — in detail

Confirm whether silc-server 1.0.2 (or any version using the vulnerable SILC_SERVER_CMD_FUNC command handler in apps/silcd/command.c) is deployed and reachable from untrusted networks. No vendor patch or fixed version is documented in current findings, so check the upstream SILC project repository/mailing list directly for any later release or backported fix beyond 1.0.2. As a temporary workaround, firewall the SILC daemon to trusted networks only and consider running it behind a reverse proxy or VPN to filter malformed command requests. Monitor server logs and process uptime for repeated crashes/restarts, which would indicate active probing. This CVE is not in CISA's Known Exploited Vulnerabilities catalog, so there is no federal remediation deadline attached.

Technical context

CVSS 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C) reflects a network-exploitable, low-complexity, unauthenticated availability-only impact (daemon crash via NULL pointer dereference, CWE-476). EPSS places exploitation likelihood in a low-to-moderate band with a flat trend, and the CVE is not listed in CISA KEV; no public exploit code or confirmed in-the-wild activity has been recorded. Exploit maturity is effectively theoretical/historical (CVE from 2007) despite recent rising press attention, which should not be read as evidence of new exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS96th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

10% chance of exploitation activity in the next 30 days, which ranks it in the 96th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Rising.

Lifecycle

8 events over 7150 days, from the signal feeds we watch.

2026-10-03EPSS band changelow → moderateepss band change
2026-06-25OpenVAS check added
2026-06-22EPSS band changemoderate → low
2026-04-23Record updated
2007-03-07Publishedweakness classified, att&ck mapped

Affected products

silcoss-projectaka secure internet live conferencing, silc client
- silc-serverMixedCommunications / video-conferencing

And 1 more affected product. See all after sign-in

Technical detail

CVSS 2.0 vector

Open in the CVSS calculator

AV:N/AC:L/Au:N/C:N/I:N/A:C

Scored 7.8 by NVD.

How it is reached

Access Vector NetworkExploitable remotely over the network
Access Complexity LowNo special conditions required
Authentication NoneNo authentication required

Impact if exploited

Confidentiality NoneNo confidentiality impact
Integrity NoneNo integrity impact
Availability CompleteTotal shutdown of the affected resource

Weaknesses

CWE-476No name in the record

ATT&CK techniques

Mapped from the weaknesses above (CWE to ATT&CK), not observed in attacks.

ImpactT1499Endpoint Denial of Servicemedium confidence
Initial AccessT1190Exploit Public-Facing Applicationlow confidence

Sources

References in the record

And 4 more references. See all after sign-in

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Silc-server, not every advisory.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account