CVE-2019-25686

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2019-25686
Core FTP 2.0 build 653 contains a denial of service vulnerability in the PBSZ command that allows unauthenticated attackers to crash the service by sending a malformed command with an oversized buffer. Attackers can send a PBSZ command with a payload exceeding 211 bytes to trigger an access violation and crash the FTP server process.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
http://coreftp.com/server/download/archive/CoreFTPServer653.exe Product
http://www.coreftp.com/ Product
https://www.exploit-db.com/exploits/46532 Exploit VDB Entry
https://www.vulncheck.com/advisories/core-ftp-build-653-pbsz-unauthenticated-denial-of-service Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:coreftp:core_ftp:2.0:build_653:*:*:*:*:*:*
History

24 Jul 2026, 22:10

Type Values Removed Values Added
Summary
  • (es) Core FTP 2.0 build 653 contiene una vulnerabilidad de denegación de servicio en el comando PBSZ que permite a atacantes no autenticados bloquear el servicio enviando un comando malformado con un búfer sobredimensionado. Los atacantes pueden enviar un comando PBSZ con una carga útil que excede los 211 bytes para desencadenar una violación de acceso y bloquear el proceso del servidor FTP.

09 Apr 2026, 19:03

Type Values Removed Values Added
First Time Coreftp
Coreftp core Ftp
CPE cpe:2.3:a:coreftp:core_ftp:2.0:build_653:*:*:*:*:*:*
References () http://coreftp.com/server/download/archive/CoreFTPServer653.exe - () http://coreftp.com/server/download/archive/CoreFTPServer653.exe - Product
References () http://www.coreftp.com/ - () http://www.coreftp.com/ - Product
References () https://www.exploit-db.com/exploits/46532 - () https://www.exploit-db.com/exploits/46532 - Exploit, VDB Entry
References () https://www.vulncheck.com/advisories/core-ftp-build-653-pbsz-unauthenticated-denial-of-service - () https://www.vulncheck.com/advisories/core-ftp-build-653-pbsz-unauthenticated-denial-of-service - Third Party Advisory

05 Apr 2026, 21:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-04-05 21:16

Updated : 2026-07-24 22:10

NVD link : CVE-2019-25686

Mitre link : CVE-2019-25686

CVE.ORG link : CVE-2019-25686

JSON object : View

Products Affected

coreftp

  • core_ftp
CWE
CWE-306

Missing Authentication for Critical Function