# CVE-2019-25711: Nsasoft SpotFTP Password Recover denial of service in Name field

Source: https://junglewise.ai/threats/cve-2019-25711-nsasoft-spotftp-password-recover-denial-of-service-in-name-field  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-12. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2019-25711 · Severity: medium · CVSS 6.2 · Published 2026-04-12

SpotFTP Password Recover, a tool used to retrieve lost FTP credentials, is vulnerable to a flaw that allows a local user to crash the software. By entering an excessively long name during the product registration process, an attacker can cause the application to stop responding. This impact is limited to the local machine and primarily affects the availability of the password recovery tool.

Technologies: [Nsasoft Spotftp](https://junglewise.ai/threats/technologies/spotftp). Vendors: [Nsasoft](https://junglewise.ai/threats/vendors/nsasoft).

## Quick answers

**Is CVE-2019-25711 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-25711 being exploited in the wild.

**How severe is CVE-2019-25711?** Medium severity, with a CVSS score of 6.2, published 12 April 2026.

**Which products and versions are affected?** Nsasoft SpotFTP Password Recover 2.4.2.

**Is there a fix for CVE-2019-25711?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2019-25711 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2019-25711?** Check whether you run Nsasoft Spotftp. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A denial of service vulnerability exists in SpotFTP Password Recover 2.4.2 due to improper handling of input length in the registration interface. A local attacker can trigger a crash by inputting a 256-byte payload into the 'Name' field and submitting a registration code. The vulnerability appears to be a buffer overflow or similar memory corruption issue resulting from reliance on untrusted inputs (CWE-807). While the primary reported impact is application instability (DoS), some scoring assessments suggest potential for broader memory access. No official patch is currently documented in the advisory.

## Affected products

- Nsasoft SpotFTP Password Recover 2.4.2

## Timeline

- 2019-01-04: other: Vulnerability discovered
- 2019-01-07: disclosed: Exploit-DB PoC published
- 2026-04-12: advisory: NVD/VulnCheck advisory published

## References

- [https://www.exploit-db.com/exploits/46088](https://www.exploit-db.com/exploits/46088)
- [https://www.vulncheck.com/advisories/spotftp-password-recover-denial-of-service-via-name-field](https://www.vulncheck.com/advisories/spotftp-password-recover-denial-of-service-via-name-field)

## Related threats

- [Nsasoft SpotFTP buffer overflow in registration name field](https://junglewise.ai/threats/cve-2020-37209-nsasoft-spotftp-buffer-overflow-in-registration-name-field)
- [Nsasoft SpotFTP buffer overflow in registration key field](https://junglewise.ai/threats/cve-2020-37208-nsasoft-spotftp-buffer-overflow-in-registration-key-field)