CVE-2018-25254
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk56th percentile - higher than 56% of all known CVEs
Summary
NICO-FTP 3.0.1.19 contains a structured exception handler buffer overflow vulnerability that allows remote attackers to execute arbitrary code by sending crafted FTP commands. Attackers can connect to the FTP service and send oversized data in response handlers to overwrite SEH pointers and redirect execution to injected shellcode.
Risk Assessment
A remote attacker can execute arbitrary code on the FTP server, potentially leading to full system compromise and access to sensitive data.
Recommendation
Immediately update NICO-FTP to a version that does not contain this vulnerability, or replace it with a more secure FTP solution.
Original NVD description (English source)
NICO-FTP 3.0.1.19 contains a structured exception handler buffer overflow vulnerability that allows remote attackers to execute arbitrary code by sending crafted FTP commands. Attackers can connect to the FTP service and send oversized data in response handlers to overwrite SEH pointers and redirect execution to injected shellcode.