How severe is CVE-2009-1431?

CVE-2009-1431 has a CVSS 2.0 base score of 9.3, rated critical severity.

Is CVE-2009-1431 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 8% (94th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2009-1431?

CVE-2009-1431 primarily affects Symantec Antivirus. In total, 7 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2009-1431?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2009-1431 published?

CVE-2009-1431 was published on 2009-04-29 and last updated on 2026-06-16.

CVE-2009-1431

CVE-2009-1431 is a critical-severity vulnerability in Symantec Antivirus with a CVSS 2.0 base score of 9.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Critical (CVSS 2.0 base score 9.3)
EPSS exploit prediction: 8% (94th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Symantec Antivirus
Published: 2009-04-29
Last modified: 2026-06-16

Description

XFR.EXE in the Intel File Transfer service in the console in Symantec Alert Management System 2 (AMS2), as used in Symantec System Center (SSS); Symantec AntiVirus Server; Symantec AntiVirus Central Quarantine Server; Symantec AntiVirus (SAV) Corporate Edition 9 before 9.0 MR7, 10.0 and 10.1 before 10.1 MR8, and 10.2 before 10.2 MR2; Symantec Client Security (SCS) 2 before 2.0 MR7 and 3 before 3.1 MR8; and Symantec Endpoint Protection (SEP) before 11.0 MR3, allows remote attackers to execute arbitrary code by placing the code on a (1) share or (2) WebDAV server, and then sending the UNC share pathname to this service.

Frequently asked questions

What is CVE-2009-1431?: XFR.EXE in the Intel File Transfer service in the console in Symantec Alert Management System 2 (AMS2), as used in Symantec System Center (SSS); Symantec AntiVirus Server; Symantec AntiVirus Central Quarantine Server; Symantec AntiVirus (SAV) Corporate Edition 9 before 9.0 MR7, 10.0 and 10.1 before 10.1 MR8, and 10.2 before 10.2 MR2; Symantec Client Security (SCS) 2 before 2.0 MR7 and 3 before 3.1 MR8; and Symantec Endpoint Protection (SEP) before 11.0 MR3, allows remote attackers to execute arbitrary code by placing the code on a (1) share or (2) WebDAV server, and then sending the UNC share pathname to this service.
How severe is CVE-2009-1431?: CVE-2009-1431 has a CVSS 2.0 base score of 9.3, rated critical severity.
Is CVE-2009-1431 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 8% (94th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2009-1431?: CVE-2009-1431 primarily affects Symantec Antivirus. In total, 7 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2009-1431?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2009-1431 published?: CVE-2009-1431 was published on 2009-04-29 and last updated on 2026-06-16.

References

Affected products (7)

cpe:2.3:a:symantec:antivirus:*:-:corporate:*:*:*:*:*
cpe:2.3:a:symantec:antivirus:*:*:corporate:*:*:*:*:*
cpe:2.3:a:symantec:antivirus:-:-:srv:*:*:*:*:*
cpe:2.3:a:symantec:antivirus_central_quarantine_server:*:*:*:*:*:*:*:*
cpe:2.3:a:symantec:client_security:*:*:*:*:*:*:*:*
cpe:2.3:a:symantec:endpoint_protection:*:*:*:*:*:*:*:*
cpe:2.3:a:symantec:system_center:*:*:*:*:*:*:*:*

More vulnerabilities in Symantec Antivirus

CVE-2010-0108 — Critical (CVSS 10.0): Buffer overflow in the cliproxy.objects.1 ActiveX control in the Symantec Client Proxy (CLIproxy.dll) in Symantec…
CVE-2009-1429 — Critical (CVSS 10.0): The Intel LANDesk Common Base Agent (CBA) in Symantec Alert Management System 2 (AMS2), as used in Symantec System…
CVE-2012-4953 — Critical (CVSS 9.3): The decomposer engine in Symantec Endpoint Protection (SEP) 11.0, Symantec Endpoint Protection Small Business Edition…
CVE-2011-0688 — Critical (CVSS 9.3): Intel Alert Management System (aka AMS or AMS2), as used in Symantec Antivirus Corporate Edition (SAVCE) 10.x before…
CVE-2010-0111 — Critical (CVSS 9.3): HDNLRSVC.EXE in the Intel Alert Handler service (aka Symantec Intel Handler service) in Intel Alert Management System…
CVE-2009-1430 — Critical (CVSS 9.3): Multiple stack-based buffer overflows in IAO.EXE in the Intel Alert Originator Service in Symantec Alert Management…

All CVEs affecting Symantec Antivirus →