CVE-2019-25686

HighCVSS 7.5

Published: 05/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.47%

38th percentile - higher than 38% of all known CVEs

Summary

Core FTP 2.0 build 653 has a DoS vulnerability in the PBSZ command. An unauthenticated attacker can send a malformed PBSZ command with a buffer exceeding 211 bytes, triggering an access violation and crashing the FTP server.

Risk Assessment

An attacker can remotely crash the FTP server, making the service unavailable.

Recommendation

Update Core FTP to a newer version if available, or apply a firewall to block unauthorized PBSZ commands.

Other vulnerabilities in Core FTP

CVE-2013-3930High
A stack-based buffer overflow in Core FTP before version 2.2 build 1785 allows remote FTP servers to execute arbitrary code via a crafted directory name in a CWD command reply.

Original NVD description (English source)

Core FTP 2.0 build 653 contains a denial of service vulnerability in the PBSZ command that allows unauthenticated attackers to crash the service by sending a malformed command with an oversized buffer. Attackers can send a PBSZ command with a payload exceeding 211 bytes to trigger an access violation and crash the FTP server process.