CVE-2013-1710: The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird b…

Is it exploited?

Reported, not confirmed by CISA. VulnCheck KEV lists it as exploited in the wild. CISA has not added it to its Known Exploited Vulnerabilities catalog as of 29 Oct 2026.

VulnCheck KEV lists it since 9 Jan 2017. It cites 1 public report, the first from 9 Jan 2017.

• trustwave.com

How likely is exploitation in the next 30 days?

41.7%

Up from 40.1% on 23 Oct 2026.

EPSS score, percentile 98.7 of all scored records. A probability estimated by FIRST, not a report of exploitation.

How severe?

Not scored

The CVE record carries no CVSS score.

What should I do?

CISA has set no required action, because the vulnerability is not in KEV.

Advisories and patches (2)

Which versions are affected?

Not stated. The CVE record gives vendor and product as “n/a” and the version as “unspecified”.

Source: CISA KEV 2026.10.29, as of 29 Oct 2026; VulnCheck KEV, as of 30 Oct 2026; FIRST EPSS, as of 30 Oct 2026; CVE List, as of 30 Oct 2026. About the data.

Description

The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 allows remote attackers to execute arbitrary JavaScript code or conduct cross-site scripting (XSS) attacks via vectors related to Certificate Request Message Format (CRMF) request generation.

Source: CVE List, as of 30 Oct 2026. About the data.

What to do

Advisories and patches

• DSA-2746 (Vendor advisory)
• DSA-2735 (Vendor advisory)

This summary is based on the CVE record as of 30 Oct 2026. Check the vendor's advisory before you act: affected versions and fixes can change.

Affected products and versions

The CVE record does not name affected products or versions: vendor and product are “n/a” and the version is “unspecified”.

Source: CVE List, as of 30 Oct 2026. About the data.

Timeline

Known exploited Mozilla vulnerabilities

• CVE-2010-3765: Mozilla Multiple Products Remote Code Execution Vulnerability (added 6 Oct 2025)
• CVE-2024-9680: Mozilla Firefox Use-After-Free Vulnerability (added 15 Oct 2024)
• CVE-2016-9079: Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability (added 22 Jun 2023)
• CVE-2015-4495: Mozilla Firefox Security Feature Bypass Vulnerability (added 25 May 2022)
• CVE-2019-11707: Mozilla Firefox and Thunderbird Type Confusion Vulnerability (added 23 May 2022)