CVE-2019-25613
Echatserver Easy Chat Server 3.1
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2019-25613 is a high-severity Improper Verification of Source of a Communication Channel (CWE-940) vulnerability in Echatserver Easy Chat Server. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 41th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SC-5 (Denial-of-service Protection) and SC-6 (Resource Availability) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2019-25613 is a denial of service vulnerability affecting Easy Chat Server 3.1. The flaw arises from the application's failure to properly handle oversized data in the message parameter, classified under CWE-940. It enables remote attackers to crash the server, as indicated by its CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), emphasizing high availability impact with network accessibility and no authentication required.
Any remote attacker can exploit this vulnerability without privileges. The attack begins by establishing a session through the chat.ghp endpoint, followed by sending a POST request to body2.ghp containing an excessively large message parameter value. This triggers the service to crash, disrupting availability for all users.
Reference advisories include a VulnCheck report detailing the denial of service via the message parameter and a proof-of-concept exploit published on Exploit-DB (ID 46806). Vendor resources are available at echatserver.com, including the ecssetup.exe download, though no specific patch details are outlined in the provided information.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19967
Vulnerability Data
Easy Chat Server 3.1 contains a denial of service vulnerability that allows remote attackers to crash the application by sending oversized data in the message parameter. Attackers can establish a session via the chat.ghp endpoint and then send a POST…
more
request to body2.ghp with an excessively large message parameter value to cause the service to crash.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE directly enables remote exploitation of an application flaw to crash the server and deny availability (T1499.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the CVE by enforcing validation of the message parameter size to reject oversized inputs before processing.
Provides denial-of-service protection mechanisms to block oversized data attacks targeting the body2.ghp endpoint.
Ensures resource availability by limiting consumption from oversized POST requests that could crash the chat server.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Authentication of users/services/hardware directly enforces source verification for communication channels.
Verifying identity assertions prevents spoofed channel origins but does not cover all channel-establishment scenarios.
Network protections reduce unauthorized channel usage but do not specifically require origin verification at channel setup.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure authentication mechanisms verify the identity and origin of communication channel initiators.
Network security controls enforce source verification and channel authentication for incoming communications.
Security of network services includes validating the origin of service requests and connections.
Network segregation limits exposure but does not directly verify source of individual channels.
Cryptography can support channel authentication but does not inherently verify source without proper implementation.
Application security requirements may specify origin checks but do not mandate them.