CVE-2019-25619
Published: 22 March 2026
Summary
CVE-2019-25619 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Ftpshell Ftpshell Server. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 11.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2019-25619 is a buffer overflow vulnerability (CWE-787) affecting FTP Shell Server version 6.83, specifically in the 'Account name to ban' field within the Manage FTP Accounts dialog. The flaw allows local attackers to supply a crafted string that triggers the overflow, enabling arbitrary code execution. It carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high impact on confidentiality, integrity, and availability.
Local attackers can exploit this vulnerability with low complexity and no required privileges or user interaction. By injecting shellcode through the account name parameter, they overwrite the return address on the stack, allowing execution of arbitrary commands such as calc.exe or other payloads.
Advisories and proof-of-concept exploits detail the issue, available at the vendor site (http://www.ftpshell.com/index.htm), Exploit-DB (https://www.exploit-db.com/exploits/46685), and VulnCheck (https://www.vulncheck.com/advisories/ftp-shell-server-buffer-overflow-via-account-name). No patch or mitigation details are specified in the available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19979
Vulnerability details
FTP Shell Server 6.83 contains a buffer overflow vulnerability in the 'Account name to ban' field that allows local attackers to execute arbitrary code by supplying a crafted string. Attackers can inject shellcode through the account name parameter in the…
more
Manage FTP Accounts dialog to overwrite the return address and execute calc.exe or other commands.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local buffer overflow enabling arbitrary code execution directly maps to exploitation for privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents buffer overflows by requiring validation of inputs like the crafted string in the 'Account name to ban' field.
Mitigates exploitation of the buffer overflow vulnerability through memory protections such as DEP, ASLR, and stack canaries to block arbitrary code execution.
Ensures timely patching or upgrading of FTP Shell Server to remediate the specific buffer overflow flaw in version 6.83.