CVE-2018-25366

CuteFTP 5.0 XP contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code by injecting malicious payload into the Site Manager label field. Attackers can craft a payload exceeding 520 bytes that overwrites the return address and executes shellcode when a shortcut is created and launched.

CVSS v3 8.4 HIGH

8.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.5 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
http://installer.globalscape.com/pub/cuteftp/archive/english/cuteftp50.exe
https://www.exploit-db.com/exploits/45259
https://www.vulncheck.com/advisories/cuteftp-xp-buffer-overflow-via-site-manager-label-field

Configurations

No configuration.

History

23 Jul 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) CuteFTP 5.0 XP contiene una vulnerabilidad de desbordamiento de búfer que permite a atacantes locales ejecutar código arbitrario inyectando una carga útil maliciosa en el campo de etiqueta del Administrador de Sitios. Los atacantes pueden crear una carga útil que exceda los 520 bytes que sobrescribe la dirección de retorno y ejecuta shellcode cuando se crea y se lanza un acceso directo.

25 May 2026, 15:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-05-25 15:16

Updated : 2026-07-23 19:10

NVD link : CVE-2018-25366

Mitre link : CVE-2018-25366

CVE.ORG link : CVE-2018-25366

JSON object : View

Products Affected

No product.

CWE

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

{"id": "CVE-2018-25366", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2018-25366", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-26T18:38:10.576259Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.5}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.6, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "globalscape", "product": "CuteFTP", "versions": [{"status": "affected", "version": "5.0.4"}]}]}], "published": "2026-05-25T15:16:19.317", "references": [{"url": "http://installer.globalscape.com/pub/cuteftp/archive/english/cuteftp50.exe", "source": "disclosure@vulncheck.com"}, {"url": "https://www.exploit-db.com/exploits/45259", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/cuteftp-xp-buffer-overflow-via-site-manager-label-field", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-120"}]}], "descriptions": [{"lang": "en", "value": "CuteFTP 5.0 XP contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code by injecting malicious payload into the Site Manager label field. Attackers can craft a payload exceeding 520 bytes that overwrites the return address and executes shellcode when a shortcut is created and launched."}, {"lang": "es", "value": "CuteFTP 5.0 XP contiene una vulnerabilidad de desbordamiento de b\u00fafer que permite a atacantes locales ejecutar c\u00f3digo arbitrario inyectando una carga \u00fatil maliciosa en el campo de etiqueta del Administrador de Sitios. Los atacantes pueden crear una carga \u00fatil que exceda los 520 bytes que sobrescribe la direcci\u00f3n de retorno y ejecuta shellcode cuando se crea y se lanza un acceso directo."}], "lastModified": "2026-07-23T19:10:00.120", "sourceIdentifier": "disclosure@vulncheck.com"}