CVE-2009-5135 [Medium] | Input Validation Bypass in Echo

CVE-2009-5135 is rated High Exploit Risk (63.2/100): CVSS Medium severity, with high exploitation likelihood (EPSS 9.92%, 95th percentile). 3 public exploit reference(s) are indexed (Exploit-DB). Public exploits are available—assess exposure, apply mitigations, and prioritize patching.

EDB-ID	Source	Kind	Published	Link
8191	exploit_db	edb	2009-03-10	Exploit-DB ↗
—	nvd_ref	exploit_tag		Exploit-DB ↗
—	nvd_ref	exploit_tag		Exploit-DB ↗

EDB-ID

Source

Kind

Published

Link

8191

exploit_db

edb

2009-03-10

Exploit-DB ↗

—

nvd_ref

exploit_tag

Exploit-DB ↗

—

nvd_ref

exploit_tag

Exploit-DB ↗

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-06-15	18.75%	9.92%	-8.83%
2	2026-02-19	16.66%	18.75%	+2.09%
3	2025-03-30	—	16.66%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-06-15

18.75%

9.92%

-8.83%

2026-02-19

16.66%

18.75%

+2.09%

2025-03-30

—

16.66%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
5.0	2.0	MEDIUM	`AV:N/AC:L/Au:N/C:P/I:N/A:N` Click to expand Access vector (AV:N) Can be exploited remotely over network reachability. Access complexity (AC:L) Exploitation conditions are straightforward and predictable. Authentication (AU:N) No authentication is required. Confidentiality impact (C:P) Partial confidentiality impact. Integrity impact (I:N) No integrity impact. Availability impact (A:N) No availability impact.	10.0	2.9	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

5.0

2.0

MEDIUM

AV:N/AC:L/Au:N/C:P/I:N/A:N Click to expand

Access vector (AV:N): Can be exploited remotely over network reachability.
Access complexity (AC:L): Exploitation conditions are straightforward and predictable.
Authentication (AU:N): No authentication is required.
Confidentiality impact (C:P): Partial confidentiality impact.
Integrity impact (I:N): No integrity impact.
Availability impact (A:N): No availability impact.

10.0

2.9

[email protected]

Affected software / configurations for CVE-2009-5135

Vendor	Product	Version	Raw CPE
nextapp	echo	<= 2.1.0	cpe:2.3:a:nextapp:echo::rc5::::::*
nextapp	echo	2.0	cpe:2.3:a:nextapp:echo:2.0:alpha1::::::
nextapp	echo	2.0	cpe:2.3:a:nextapp:echo:2.0:alpha10::::::
nextapp	echo	2.0	cpe:2.3:a:nextapp:echo:2.0:alpha11::::::
nextapp	echo	2.0	cpe:2.3:a:nextapp:echo:2.0:alpha12::::::
nextapp	echo	2.0	cpe:2.3:a:nextapp:echo:2.0:alpha13::::::
nextapp	echo	2.0	cpe:2.3:a:nextapp:echo:2.0:alpha14::::::
nextapp	echo	2.0	cpe:2.3:a:nextapp:echo:2.0:alpha15::::::
nextapp	echo	2.0	cpe:2.3:a:nextapp:echo:2.0:alpha16::::::
nextapp	echo	2.0	cpe:2.3:a:nextapp:echo:2.0:alpha2::::::
nextapp	echo	2.0	cpe:2.3:a:nextapp:echo:2.0:alpha3::::::
nextapp	echo	2.0	cpe:2.3:a:nextapp:echo:2.0:alpha4::::::
nextapp	echo	2.0	cpe:2.3:a:nextapp:echo:2.0:alpha5::::::
nextapp	echo	2.0	cpe:2.3:a:nextapp:echo:2.0:alpha6::::::
nextapp	echo	2.0	cpe:2.3:a:nextapp:echo:2.0:alpha7::::::
nextapp	echo	2.0	cpe:2.3:a:nextapp:echo:2.0:alpha8::::::
nextapp	echo	2.0	cpe:2.3:a:nextapp:echo:2.0:alpha9::::::
nextapp	echo	2.0	cpe:2.3:a:nextapp:echo:2.0:beta1::::::
nextapp	echo	2.0	cpe:2.3:a:nextapp:echo:2.0:beta2::::::
nextapp	echo	2.0	cpe:2.3:a:nextapp:echo:2.0:beta3::::::
nextapp	echo	2.0	cpe:2.3:a:nextapp:echo:2.0:beta4::::::
nextapp	echo	2.0	cpe:2.3:a:nextapp:echo:2.0:rc1::::::
nextapp	echo	2.0	cpe:2.3:a:nextapp:echo:2.0:rc2::::::
nextapp	echo	2.0	cpe:2.3:a:nextapp:echo:2.0:rc3::::::
nextapp	echo	2.0	cpe:2.3:a:nextapp:echo:2.0:rc4::::::
nextapp	echo	2.0	cpe:2.3:a:nextapp:echo:2.0:rc5::::::
nextapp	echo	2.0	cpe:2.3:a:nextapp:echo:2.0:rc6::::::
nextapp	echo	2.0	cpe:2.3:a:nextapp:echo:2.0:rc7::::::
nextapp	echo	2.0.1	cpe:2.3:a:nextapp:echo:2.0.1:test1::::::
nextapp	echo	2.0.1	cpe:2.3:a:nextapp:echo:2.0.1:test2::::::
nextapp	echo	2.0.1	cpe:2.3:a:nextapp:echo:2.0.1:test3::::::
nextapp	echo	2.1.0	cpe:2.3:a:nextapp:echo:2.1.0:beta1::::::
nextapp	echo	2.1.0	cpe:2.3:a:nextapp:echo:2.1.0:beta2::::::
nextapp	echo	2.1.0	cpe:2.3:a:nextapp:echo:2.1.0:beta3::::::
nextapp	echo	2.1.0	cpe:2.3:a:nextapp:echo:2.1.0:beta4::::::
nextapp	echo	2.1.0	cpe:2.3:a:nextapp:echo:2.1.0:beta5::::::
nextapp	echo	2.1.0	cpe:2.3:a:nextapp:echo:2.1.0:rc1::::::
nextapp	echo	2.1.0	cpe:2.3:a:nextapp:echo:2.1.0:rc2::::::
nextapp	echo	2.1.0	cpe:2.3:a:nextapp:echo:2.1.0:rc3::::::
nextapp	echo	2.1.0	cpe:2.3:a:nextapp:echo:2.1.0:rc4::::::
nextapp	echo	3.0	cpe:2.3:a:nextapp:echo:3.0:beta1::::::
nextapp	echo	3.0	cpe:2.3:a:nextapp:echo:3.0:beta2::::::
nextapp	echo	3.0	cpe:2.3:a:nextapp:echo:3.0:beta3::::::
nextapp	echo	3.0	cpe:2.3:a:nextapp:echo:3.0:beta4::::::
nextapp	echo	3.0	cpe:2.3:a:nextapp:echo:3.0:beta5::::::

References for CVE-2009-5135

URL	Tags
http://echo.nextapp.com/site/node/5742	Vendor Advisory
http://secunia.com/advisories/34218	Vendor Advisory
http://www.exploit-db.com/exploits/8191/	Exploit
http://www.securityfocus.com/archive/1/501637/100/0/threaded
http://www.vupen.com/english/advisories/2009/0653
https://exchange.xforce.ibmcloud.com/vulnerabilities/49167
https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20090305-0_echo_nextapp_xml_injection.txt	Exploit

URL

CVE-2009-5135

Public exploit references (Exploit-DB) for CVE-2009-5135

Exploit prediction scoring system (EPSS) score for CVE-2009-5135

Common vulnerability scoring system (CVSS) metrics for CVE-2009-5135

Weakness enumeration for CVE-2009-5135

Affected software / configurations for CVE-2009-5135

References for CVE-2009-5135