How severe is CVE-2004-2049?

CVE-2004-2049 has a CVSS 2.0 base score of 4.6, rated medium severity.

Is CVE-2004-2049 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (28th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2004-2049?

CVE-2004-2049 primarily affects Esesix Thintune Extreme. In total, 7 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2004-2049?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2004-2049 published?

CVE-2004-2049 was published on 2004-12-31 and last updated on 2026-06-16.

CVE-2004-2049

CVE-2004-2049 is a medium-severity vulnerability in Esesix Thintune Extreme with a CVSS 2.0 base score of 4.6. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Medium (CVSS 2.0 base score 4.6)
EPSS exploit prediction: 0% (28th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Esesix Thintune Extreme
Published: 2004-12-31
Last modified: 2026-06-16

Description

eSeSIX Thintune thin clients running firmware 2.4.38 and earlier store sensitive usernames and passwords in cleartext in configuration files for the keeper library, which allows attackers to gain access.

Frequently asked questions

What is CVE-2004-2049?: eSeSIX Thintune thin clients running firmware 2.4.38 and earlier store sensitive usernames and passwords in cleartext in configuration files for the keeper library, which allows attackers to gain access.
How severe is CVE-2004-2049?: CVE-2004-2049 has a CVSS 2.0 base score of 4.6, rated medium severity.
Is CVE-2004-2049 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (28th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2004-2049?: CVE-2004-2049 primarily affects Esesix Thintune Extreme. In total, 7 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2004-2049?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2004-2049 published?: CVE-2004-2049 was published on 2004-12-31 and last updated on 2026-06-16.

References

Affected products (7)

cpe:2.3:h:esesix:thintune_extreme:2.4.38:*:*:*:*:*:*:*
cpe:2.3:h:esesix:thintune_l:2.4.38:*:*:*:*:*:*:*
cpe:2.3:h:esesix:thintune_m:2.4.38:*:*:*:*:*:*:*
cpe:2.3:h:esesix:thintune_mobile:2.4.38:*:*:*:*:*:*:*
cpe:2.3:h:esesix:thintune_s:2.4.38:*:*:*:*:*:*:*
cpe:2.3:h:esesix:thintune_xm:2.4.38:*:*:*:*:*:*:*
cpe:2.3:h:esesix:thintune_xs:2.4.38:*:*:*:*:*:*:*

More vulnerabilities in Esesix Thintune Extreme

CVE-2004-2048 — Critical (CVSS 10.0): radmin in eSeSIX Thintune thin clients running firmware 2.4.38 and earlier starts a process port 25072 that can be…
CVE-2004-2051 — Medium (CVSS 5.0): The Phoenix browser in eSeSIX Thintune thin clients running firmware 2.4.38 and earlier allows local users to read…
CVE-2004-2050 — Medium (CVSS 4.6): eSeSIX Thintune thin clients running firmware 2.4.38 and earlier allow local users to gain privileges by pressing…

All CVEs affecting Esesix Thintune Extreme →