What is CVE-2009-2948?

CVE-2009-2948 is a vulnerability in Samba, classified under Incorrect Permission Assignment for Critical Resource. Published 2009-10-07.

Is CVE-2009-2948 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Samba

CVE-2009-2948

mount.cifs in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8 and 3.4 before 3.4.2, when mount.cifs is installed suid root, does not properly enforce permissions, which allows local users to read part of the credentials file and obtain the password by specifying the path to the credentials file and using the --verbose or -v option.

Published 2009-10-07 · last modified 2026-06-16.

CVSS v2 metric

CVSS v2 base score 1.9 (Low). Vector: AV:L/AC:M/Au:N/C:P/I:N/A:N. This CVE predates CVSS v3 and has no v3 score from NVD.

EPSS exploit prediction

EPSS: 0.005 (41.9th percentile), scored 2026-09-29.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 42nd percentile — 41.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000

Affected products

Samba

Weakness classification (CWE)

CWE-732 — Incorrect Permission Assignment for Critical Resource

Public proof-of-concept exploits

Live-Hack-CVE/CVE-2009-2948

References

www.samba.org/samba/security/CVE-2009-2948.html (Patch, Vendor Advisory)
news.samba.org/releases/3.4.2/ (Broken Link, Vendor Advisory)
www.redhat.com/archives/fedora-package-announce/2009-October/msg00098.html (vendor-advisory, Patch, Third Party Advisory)
osvdb.org/58520 (vdb-entry, Broken Link)
www.securitytracker.com/id (Patch, VDB Entry, Third Party Advisory, vdb-entry, Broken Link)
news.samba.org/releases/3.2.15/ (Broken Link, Vendor Advisory)
oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:7087 (Broken Link, signature, Third Party Advisory, vdb-entry)
www.securityfocus.com/bid/36572 (Patch, VDB Entry, Third Party Advisory, vdb-entry)
www.vupen.com/english/advisories/2009/2810 (Permissions Required, vdb-entry, Vendor Advisory)
slackware.com/security/viewer.php (vendor-advisory, Patch, Third Party Advisory)

Frequently asked questions

What is CVE-2009-2948?: CVE-2009-2948 is a vulnerability in Samba, classified under Incorrect Permission Assignment for Critical Resource. Published 2009-10-07.
Is CVE-2009-2948 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.