CVE-2019-25321

CriticalPublic PoC

Published: 12 February 2026

Published

12 February 2026

Modified

03 March 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0054 67.8th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2019-25321 is a critical-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Internet-Soft Ftp Navigator. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked in the top 32.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Client Execution (T1203). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly requires timely identification, reporting, and correction of flaws like the stack buffer overflow in CVE-2019-25321, eliminating the vulnerability through patching or removal.

SI-16 Memory Protection good match

prevent

Implements memory safeguards such as DEP, ASLR, and stack canaries that prevent successful SEH register overwrites and arbitrary code execution from stack overflows.

SI-10 Information Input Validation good match

prevent

Mandates validation of information inputs like those pasted into the Custom Command textbox to block malicious payloads triggering the buffer overflow.

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution

Adversaries may exploit software vulnerabilities in client applications to execute code.

attack.mitre.org →

Why these techniques?

Stack-based buffer overflow in FTP Navigator client application enables remote arbitrary code execution, directly mapping to Exploitation for Client Execution (T1203).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

FTP Navigator 8.03 contains a stack overflow vulnerability that allows attackers to execute arbitrary code by overwriting Structured Exception Handler (SEH) registers. Attackers can craft a malicious payload that triggers a buffer overflow when pasted into the Custom Command textbox,…

enabling remote code execution and launching the calculator as proof of concept.

Deeper analysisAI

CVE-2019-25321 is a stack-based buffer overflow vulnerability (CWE-121) affecting FTP Navigator version 8.03. The issue enables attackers to overwrite Structured Exception Handler (SEH) registers by crafting a malicious payload that triggers the overflow when pasted into the Custom Command textbox, resulting in arbitrary code execution.

Remote attackers can exploit this vulnerability without privileges or user interaction, as indicated by its CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Successful exploitation allows full remote code execution on the target system, with a proof-of-concept demonstrating the launch of the Windows calculator.

Advisories and related resources include the vendor site at http://www.internet-soft.com/, Exploit-DB entries at https://www.exploit-db.com/exploits/47794 and https://www.exploit-db.com/exploits/47812, and a VulnCheck advisory at https://www.vulncheck.com/advisories/ftp-navigator-stack-overflow-seh. No patch or specific mitigation details are mentioned in the CVE description.