CVE-2019-25686

HighPublic PoC

Published: 05 April 2026

Published

05 April 2026

Modified

09 April 2026

KEV Added

—

Patch

—

CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score 0.0018 38.5th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2019-25686 is a high-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Coreftp Core Ftp. Its CVSS base score is 7.5 (High).

Operationally, ranked at the 38.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly addresses the insufficient buffer size checks by requiring validation of PBSZ command payloads to reject oversized inputs exceeding 211 bytes and prevent access violations.

SI-2 Flaw Remediation good match

prevent

Mandates identification, reporting, and correction of the specific buffer handling flaw in Core FTP build 653 through patching or upgrades to eliminate the vulnerability.

SC-5 Denial-of-service Protection good match

prevent

Provides comprehensive protection against the unauthenticated remote DoS attack by limiting effects of oversized PBSZ commands that crash the FTP server process.

NVD Description

Core FTP 2.0 build 653 contains a denial of service vulnerability in the PBSZ command that allows unauthenticated attackers to crash the service by sending a malformed command with an oversized buffer. Attackers can send a PBSZ command with a…

payload exceeding 211 bytes to trigger an access violation and crash the FTP server process.

Deeper analysisAI

CVE-2019-25686 is a denial of service vulnerability in Core FTP 2.0 build 653, affecting the FTP server's handling of the PBSZ command. The flaw arises from insufficient buffer size checks, allowing a malformed PBSZ command with a payload exceeding 211 bytes to trigger an access violation and crash the server process. It is classified under CWE-306 and carries a CVSS v3.1 base score of 7.5.

Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no privileges or user interaction required (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). By sending the oversized PBSZ payload, they can reliably crash the FTP server process, resulting in a denial of service that disrupts service availability.

References include a proof-of-concept exploit on Exploit-DB (ID 46532), a VulnCheck advisory describing the unauthenticated DoS in Core FTP build 653, the vendor's homepage at coreftp.com, and a download link for the vulnerable CoreFTPServer653.exe archive. These sources confirm the issue but do not detail specific patches; security practitioners should verify updates from the vendor beyond build 653.