Cyber Resilience

CVE-2019-25349

MediumPublic PoC

Published: 18 February 2026

Published
18 February 2026
Modified
15 April 2026
KEV Added
Patch
CVSS Score v4 4.6 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0004 13.1th percentile
Risk Priority 9 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2019-25349 is a medium-severity Classic Buffer Overflow (CWE-120) vulnerability in Apple (inferred from references). Its CVSS base score is 4.6 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 13.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2019-25349 is a denial-of-service vulnerability in ScadaApp for iOS version 1.1.4.0, stemming from a buffer overflow condition (CWE-120) in the Servername field. The flaw allows attackers to crash the application by supplying an oversized input buffer, such as a 257-character string, during the login process on iOS devices. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high-impact availability disruption with network accessibility, low attack complexity, and no privileges or user interaction required.

Any unauthenticated remote attacker can exploit this vulnerability by pasting the oversized buffer into the Servername field at login, reliably causing the ScadaApp to crash and deny service to affected users on their iOS devices. Successful exploitation requires no special access or conditions beyond reaching the login interface, making it straightforward for targeted denial-of-service attacks against users of the vulnerable app version.

References include the Apple App Store page for ScadaApp, an Exploit-DB proof-of-concept (ID 47678), and a Vulncheck advisory on the Servername denial-of-service issue, which provide technical details and reproduction steps but do not specify patches or mitigations in the available information. Security practitioners should verify app updates through official channels and avoid using version 1.1.4.0 where possible.

EU & UK References

Vulnerability details

ScadaApp for iOS 1.1.4.0 contains a denial of service vulnerability that allows attackers to crash the application by inputting an oversized buffer in the Servername field. Attackers can paste a 257-character buffer during login to trigger an application crash on…

more

iOS devices.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

Buffer overflow in client app login field directly enables application crash for endpoint denial of service via exploitation (T1499.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-20115Shared CWE-120
CVE-2020-37205Shared CWE-120
CVE-2026-28875Shared CWE-120
CVE-2020-37194Shared CWE-120
CVE-2020-37180Shared CWE-120
CVE-2024-24419Shared CWE-120
CVE-2019-25353Shared CWE-120
CVE-2026-30075Shared CWE-120
CVE-2020-37213Shared CWE-120
CVE-2021-47798Shared CWE-120

Affected Assets

Apple
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Requires validation of inputs like the Servername field to prevent buffer overflows from oversized strings during login.

prevent

Enforces restrictions such as maximum length limits on information inputs to block oversized buffers that crash the application.

prevent

Limits the effects of denial-of-service events, including application crashes triggered by oversized input buffers in the login process.

References