Executive brief
Core FTP Server is a file transfer service used by organizations to share and manage files over a network. A vulnerability in how the server handles specific commands allows an unauthenticated attacker to remotely crash the service. This results in a denial-of-service condition, preventing legitimate users from accessing or transferring files until the server is manually restarted.
Technical details
A denial of service (DoS) vulnerability exists in Core FTP Server 2.0 build 653 due to improper handling of the PBSZ (Protection Buffer Size) command. An unauthenticated remote attacker can trigger an access violation by sending a PBSZ command with a payload exceeding 211 bytes. This malformed input causes the FTP server process (coresrvr.exe) to crash, specifically by overwriting registers such as ECX and triggering a memory access violation (code c0000005). While the vulnerability involves a buffer overflow that can overwrite SEH/NSEH, the presence of SafeSEH in the binary currently limits the impact to a service crash. A proof-of-concept exploit is publicly available.
Affected products
- CoreFTP Core FTP Server 2.0 build 653
Timeline
- 2019-03-12: disclosed: Initial discovery and PoC release by Hodorsec
- 2026-04-05: advisory: CVE-2019-25686 published via VulnCheck/NVD