Is CVE-2019-25434 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2019-25434 being exploited in the wild.

How severe is CVE-2019-25434?

High severity, with a CVSS score of 7.5, published 20 February 2026.

Which products and versions are affected?

Nsasoft Spotauditor 5.3.1.0 and earlier.

Is there a fix for CVE-2019-25434?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2019-25434 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2019-25434?

Check whether you run Nsasoft Spotauditor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2019-25434: Nsasoft SpotAuditor stack-based buffer overflow in registration field

CVE-2019-25434 · Severity: high · CVSS 7.5 · Published 2026-02-20

SpotAuditor, a tool used for recovering passwords and auditing network security, is vulnerable to a flaw that can cause the software to crash. By entering an excessively long name during the product registration process, an attacker can force the application to shut down unexpectedly. This results in a denial of service, preventing legitimate users from using the software for security auditing tasks.

Vendors: Nsasoft.

Quick answers

Is CVE-2019-25434 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2019-25434 being exploited in the wild.
How severe is CVE-2019-25434?: High severity, with a CVSS score of 7.5, published 20 February 2026.
Which products and versions are affected?: Nsasoft Spotauditor 5.3.1.0 and earlier.
Is there a fix for CVE-2019-25434?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2019-25434 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2019-25434?: Check whether you run Nsasoft Spotauditor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stack-based buffer overflow (CWE-121) exists in Nsasoft SpotAuditor version 5.3.1.0 and potentially earlier versions. The vulnerability is located in the registration name input field, which fails to properly validate the length of user-supplied strings. An attacker can trigger an unhandled exception and crash the application by inputting a string of 5,000 bytes or more (e.g., a long sequence of 'A' characters). While some sources categorize the attack vector as network-based, the exploit typically requires local interaction with the application's registration interface. Successful exploitation results in a complete loss of availability for the application.

Affected products

Nsasoft (Nsauditor) SpotAuditor 5.3.1.0 and earlier

Timeline

2019-10-14: disclosed: Initial exploit code published to Exploit-DB
2026-02-20: advisory: CVE published and NVD entry created

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.