CVE-2019-25353

HighPublic PoC

Published: 18 February 2026

Published

18 February 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score 0.0004 12.7th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2019-25353 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability in Foscam Video Management (inferred from references). Its CVSS base score is 7.5 (High).

Operationally, ranked at the 12.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-27 Platform-independent Applications

addresses: CWE-120

Platform-independent managed code eliminates the need for unchecked native buffer copies that are the root cause of classic buffer overflows.

NVD Description

Foscam Video Management System 1.1.4.9 contains a denial of service vulnerability in the username input field that allows attackers to crash the application. Attackers can overwrite the username with a 520-byte buffer of repeated 'A' characters to trigger an application…

crash during device login.

Deeper analysisAI

CVE-2019-25353 is a denial-of-service vulnerability in Foscam Video Management System version 1.1.4.9. The flaw exists in the username input field during device login, where attackers can trigger a buffer overflow (CWE-120) by supplying a 520-byte buffer of repeated 'A' characters, causing the application to crash. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Unauthenticated remote attackers can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation results in a denial of service, rendering the application unavailable by crashing it during login attempts, with high impact to availability but no effects on confidentiality or integrity.

Advisories and references include a proof-of-concept exploit on Exploit-DB at https://www.exploit-db.com/exploits/47671 and a VulnCheck advisory at https://www.vulncheck.com/advisories/foscam-video-management-system-username-denial-of-service. The vendor site is available at https://www.foscam.es/.