CVE-2009-4024

Argument injection vulnerability in the ping function in Ping.php in the Net_Ping package before 2.4.5 for PEAR allows remote attackers to execute arbitrary shell commands via the host parameter. NOTE: this has also been reported as a shell metacharacter problem.

Published: 2009-11-29 Last update: 2026-04-23 Assigner: [email protected] Source: [email protected]

Conclusion & alert: CVE-2009-4024 is rated High Risk (75.9/100): CVSS Critical severity, with high exploitation likelihood (EPSS 6.13%, 93th percentile). Core evidence: EPSS ranks this CVE among the most likely to be exploited in the near term. EPSS rose +3.48% over the last day, indicating growing attacker interest. Mandatory action: High exploitation likelihood—assess exposure and prioritize remediation.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2009-4024

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-15 2.65% 6.13% +3.48%
2 2026-02-14 2.81% 2.65% -0.16%
3 2025-03-30 2.81%

Full EPSS history (8 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2009-4024

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
10.0 2.0 HIGH
AV:N/AC:L/Au:N/C:C/I:C/A:C Click to expand
Access vector (AV:N)
Can be exploited remotely over network reachability.
Access complexity (AC:L)
Exploitation conditions are straightforward and predictable.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:C)
Complete confidentiality impact.
Integrity impact (I:C)
Complete integrity impact.
Availability impact (A:C)
Complete availability impact.
10.0 10.0 [email protected]

Weakness enumeration for CVE-2009-4024

OS Trackers for CVE-2009-4024

vendor priority summary link
ubuntu medium CVE-2009-4024 medium priority: Ubuntu including 1 source packages (php-net-ping), 6 status rows across 6 suites (dapper, hardy, intrepid, jaunty, karmic, upstream): released 4, DNE 1, needs-triage 1. https://ubuntu.com/security/CVE-2009-4024

Affected software / configurations for CVE-2009-4024

Vendor Product Version Raw CPE
pear pear <= 2.4.4 cpe:2.3:a:pear:pear:*:*:*:*:*:*:*:*
pear pear 0.1 cpe:2.3:a:pear:pear:0.1:*:*:*:*:*:*:*
pear pear 1.0 cpe:2.3:a:pear:pear:1.0:*:*:*:*:*:*:*
pear pear 1.0.1 cpe:2.3:a:pear:pear:1.0.1:*:*:*:*:*:*:*
pear pear 2.1 cpe:2.3:a:pear:pear:2.1:*:*:*:*:*:*:*
pear pear 2.2 cpe:2.3:a:pear:pear:2.2:*:*:*:*:*:*:*
pear pear 2.3 cpe:2.3:a:pear:pear:2.3:*:*:*:*:*:*:*
pear pear 2.4 cpe:2.3:a:pear:pear:2.4:*:*:*:*:*:*:*
pear pear 2.4.1 cpe:2.3:a:pear:pear:2.4.1:*:*:*:*:*:*:*
pear pear 2.4.2 cpe:2.3:a:pear:pear:2.4.2:*:*:*:*:*:*:*
pear pear 2.4.3 cpe:2.3:a:pear:pear:2.4.3:*:*:*:*:*:*:*

References for CVE-2009-4024

URL Tags
http://blog.pear.php.net/2009/11/14/net_traceroute-and-net_ping-security-advisory/ Patch
http://pear.php.net/advisory20091114-01.txt Vendor Advisory
http://pear.php.net/package/Net_Ping/download/2.4.5 Patch Vendor Advisory
http://secunia.com/advisories/37451 Vendor Advisory
http://secunia.com/advisories/37502
http://svn.php.net/viewvc/pear/packages/Net_Ping/trunk/Ping.php?r1=274728&r2=290669&pathrev=290669
http://www.debian.org/security/2009/dsa-1949
http://www.securityfocus.com/bid/37093
http://www.vupen.com/english/advisories/2009/3320 Patch Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/54390
https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01044.html
https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01130.html
https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01152.html
cvelogic Threat Intelligence