Is CVE-2009-2948 being actively exploited?

CVE-2009-2948 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2009-2948?

CVE-2009-2948 has a CVSS 2.0 base score of 1.9 (LOW).

CVE-2009-2948

LOW · CVSS 1.9EPSS 0.5%EU EUVD

mount.cifs in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8 and 3.4 before 3.4.2, when mount.cifs is installed suid root, does not properly enforce permissions, which allows local users to read part of the credentials file and obtain the password by specifying the path to the credentials file and using the --verbose or -v option.

Key facts

CVSS score: 1.9 (v2.0)
Severity: LOW
CVSS vector: AV:L/AC:M/Au:N/C:P/I:N/A:N
Weakness (CWE): CWE-732
EPSS score: 0.5% (44th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2009-2935)
Published: October 7, 2009
NVD last modified: June 16, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2009-2935 in the EU Vulnerability Database. Last updated in EUVD on August 7, 2024.

View on the EU Vulnerability Database

Affected products

samba / samba

References

http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html(Mailing List, Third Party Advisory)
http://news.samba.org/releases/3.0.37/(Broken Link, Vendor Advisory)
http://news.samba.org/releases/3.2.15/(Broken Link, Vendor Advisory)
http://news.samba.org/releases/3.3.8/(Broken Link, Vendor Advisory)
http://news.samba.org/releases/3.4.2/(Broken Link, Vendor Advisory)
http://osvdb.org/58520(Broken Link)
http://secunia.com/advisories/36893(Not Applicable, Vendor Advisory)
http://secunia.com/advisories/36918(Not Applicable, Vendor Advisory)
http://secunia.com/advisories/36937(Not Applicable, Vendor Advisory)
http://secunia.com/advisories/36953(Not Applicable, Vendor Advisory)
http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.561439(Patch, Third Party Advisory)
http://www.samba.org/samba/security/CVE-2009-2948.html(Patch, Vendor Advisory)
http://www.securityfocus.com/bid/36572(Patch, Third Party Advisory, VDB Entry)
http://www.securitytracker.com/id?1022975(Broken Link, Patch, Third Party Advisory, VDB Entry)
http://www.ubuntu.com/usn/USN-839-1(Third Party Advisory)
http://www.vupen.com/english/advisories/2009/2810(Permissions Required, Vendor Advisory)
https://exchange.xforce.ibmcloud.com/vulnerabilities/53574(Third Party Advisory, VDB Entry)
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10434(Broken Link, Third Party Advisory)
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7087(Broken Link, Third Party Advisory)
https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00095.html(Patch, Third Party Advisory)
https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00098.html(Patch, Third Party Advisory)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain