CVE-2019-25686
Published: 05 April 2026
Summary
CVE-2019-25686 is a high-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Coreftp Core Ftp. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 36.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2019-25686 is a denial of service vulnerability in Core FTP 2.0 build 653, affecting the FTP server's handling of the PBSZ command. The flaw arises from insufficient buffer size checks, allowing a malformed PBSZ command with a payload exceeding 211 bytes to trigger an access violation and crash the server process. It is classified under CWE-306 and carries a CVSS v3.1 base score of 7.5.
Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no privileges or user interaction required (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). By sending the oversized PBSZ payload, they can reliably crash the FTP server process, resulting in a denial of service that disrupts service availability.
References include a proof-of-concept exploit on Exploit-DB (ID 46532), a VulnCheck advisory describing the unauthenticated DoS in Core FTP build 653, the vendor's homepage at coreftp.com, and a download link for the vulnerable CoreFTPServer653.exe archive. These sources confirm the issue but do not detail specific patches; security practitioners should verify updates from the vendor beyond build 653.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-20105
Vulnerability details
Core FTP 2.0 build 653 contains a denial of service vulnerability in the PBSZ command that allows unauthenticated attackers to crash the service by sending a malformed command with an oversized buffer. Attackers can send a PBSZ command with a…
more
payload exceeding 211 bytes to trigger an access violation and crash the FTP server process.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthenticated remote exploitation of the PBSZ buffer flaw crashes the FTP server process, matching Application or System Exploitation for Endpoint DoS.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the insufficient buffer size checks by requiring validation of PBSZ command payloads to reject oversized inputs exceeding 211 bytes and prevent access violations.
Mandates identification, reporting, and correction of the specific buffer handling flaw in Core FTP build 653 through patching or upgrades to eliminate the vulnerability.
Provides comprehensive protection against the unauthenticated remote DoS attack by limiting effects of oversized PBSZ commands that crash the FTP server process.