at least one of the RCE vulns seems to be exploitable even without connecting to any network (reachable via probe response handling).