Quick answers
- Is CVE-2019-25666 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2019-25666 being exploited in the wild.
- How severe is CVE-2019-25666?
- Medium severity, with a CVSS score of 6.2, published 5 April 2026.
- Which products and versions are affected?
- Nsauditor SpotAuditor 3.6.7 and earlier.
- Is there a fix for CVE-2019-25666?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2019-25666 attacked?
- It is attacked with local access, in a network appliance.
- Am I affected by CVE-2019-25666?
- Check whether you run Nsasoft Spotauditor. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A local buffer overflow vulnerability exists in SpotAuditor version 3.6.7 and potentially earlier versions within the 'Base64 Password Decoder' component. The flaw is rooted in an out-of-bounds write (CWE-787) triggered when the application processes an oversized Base64 string provided through the decoder interface. An attacker with local access to the system can exploit this by pasting a specially crafted long string into the 'Base64 Encrypted Password' field and clicking 'Decrypt'. Successful exploitation results in an immediate application crash (Denial of Service). While currently documented as a DoS, buffer overflows of this nature can sometimes be leveraged for arbitrary code execution depending on memory protections in place.
Affected products
- Nsauditor SpotAuditor 3.6.7 and earlier
Timeline
- 2019-01-30: disclosed: Vulnerability discovered by Rafael Pedrero
- 2019-02-04: other: Proof of concept exploit published on Exploit-DB
- 2026-04-05: advisory: CVE-2019-25666 published via VulnCheck/NVD