CVE-2019-25349
Published: 18 February 2026
Summary
CVE-2019-25349 is a medium-severity Classic Buffer Overflow (CWE-120) vulnerability in Apple (inferred from references). Its CVSS base score is 4.6 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 13.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2019-25349 is a denial-of-service vulnerability in ScadaApp for iOS version 1.1.4.0, stemming from a buffer overflow condition (CWE-120) in the Servername field. The flaw allows attackers to crash the application by supplying an oversized input buffer, such as a 257-character string, during the login process on iOS devices. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high-impact availability disruption with network accessibility, low attack complexity, and no privileges or user interaction required.
Any unauthenticated remote attacker can exploit this vulnerability by pasting the oversized buffer into the Servername field at login, reliably causing the ScadaApp to crash and deny service to affected users on their iOS devices. Successful exploitation requires no special access or conditions beyond reaching the login interface, making it straightforward for targeted denial-of-service attacks against users of the vulnerable app version.
References include the Apple App Store page for ScadaApp, an Exploit-DB proof-of-concept (ID 47678), and a Vulncheck advisory on the Servername denial-of-service issue, which provide technical details and reproduction steps but do not specify patches or mitigations in the available information. Security practitioners should verify app updates through official channels and avoid using version 1.1.4.0 where possible.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19636
Vulnerability details
ScadaApp for iOS 1.1.4.0 contains a denial of service vulnerability that allows attackers to crash the application by inputting an oversized buffer in the Servername field. Attackers can paste a 257-character buffer during login to trigger an application crash on…
more
iOS devices.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in client app login field directly enables application crash for endpoint denial of service via exploitation (T1499.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of inputs like the Servername field to prevent buffer overflows from oversized strings during login.
Enforces restrictions such as maximum length limits on information inputs to block oversized buffers that crash the application.
Limits the effects of denial-of-service events, including application crashes triggered by oversized input buffers in the login process.