Raw vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2019-25619 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Ftpshell Ftpshell Server. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 12th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SI-16 (Memory Protection) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2019-25619 is a buffer overflow vulnerability (CWE-787) affecting FTP Shell Server version 6.83, specifically in the 'Account name to ban' field within the Manage FTP Accounts dialog. The flaw allows local attackers to supply a crafted string that triggers the overflow, enabling arbitrary code execution. It carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high impact on confidentiality, integrity, and availability.
Local attackers can exploit this vulnerability with low complexity and no required privileges or user interaction. By injecting shellcode through the account name parameter, they overwrite the return address on the stack, allowing execution of arbitrary commands such as calc.exe or other payloads.
Advisories and proof-of-concept exploits detail the issue, available at the vendor site (http://www.ftpshell.com/index.htm), Exploit-DB (https://www.exploit-db.com/exploits/46685), and VulnCheck (https://www.vulncheck.com/advisories/ftp-shell-server-buffer-overflow-via-account-name). No patch or mitigation details are specified in the available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19979
Vulnerability Data
FTP Shell Server 6.83 contains a buffer overflow vulnerability in the 'Account name to ban' field that allows local attackers to execute arbitrary code by supplying a crafted string. Attackers can inject shellcode through the account name parameter in the…
more
Manage FTP Accounts dialog to overwrite the return address and execute calc.exe or other commands.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local buffer overflow enabling arbitrary code execution directly maps to exploitation for privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents buffer overflows by requiring validation of inputs like the crafted string in the 'Account name to ban' field.
Mitigates exploitation of the buffer overflow vulnerability through memory protections such as DEP, ASLR, and stack canaries to block arbitrary code execution.
Ensures timely patching or upgrading of FTP Shell Server to remediate the specific buffer overflow flaw in version 6.83.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure-development practices (static analysis, bounds checking, code review) are the primary means of preventing out-of-bounds writes.
Vulnerability scanning and recording can discover out-of-bounds write flaws so they can be remediated.
Patching or replacing vulnerable software directly eliminates known instances of this coding weakness.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development and acceptance can detect and prevent out-of-bounds write defects.
Secure development life cycle mandates practices that prevent out-of-bounds writes.
Application security requirements can specify bounds-checking and safe memory handling.
Secure architecture and engineering principles reduce the likelihood of buffer overflows.
Secure coding directly addresses out-of-bounds writes through language choice and coding standards.
Change management can enforce review gates that catch unsafe memory operations before deployment.