CVE-2019-25686: 
CoreFTP Server vulnerability analysis and mitigation

CVE-2019-25686 is a denial-of-service (DoS) vulnerability in Core FTP Server 2.0 build 653, affecting the PBSZ (Protection Buffer Size) FTP command. Unauthenticated remote attackers can crash the FTP server process by sending a malformed PBSZ command with a payload exceeding 211 bytes, triggering an access violation. The vulnerability was formally published on April 5, 2026, and carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, VulnCheck).

The root cause is classified as CWE-306 (Missing Authentication for Critical Function), as the PBSZ command can be invoked without prior authentication, allowing any network-accessible attacker to interact with the vulnerable code path. The vulnerability is triggered by sending a PBSZ command with an oversized buffer exceeding 211 bytes, which causes an access violation (memory fault) in the Core FTP server process, resulting in a crash. No authentication, special privileges, or user interaction are required for exploitation. A public proof-of-concept Python script is available on Exploit-DB that demonstrates the crash (GitHub Advisory, Exploit-DB).

Successful exploitation results in a complete loss of availability for the Core FTP server service, as the server process crashes upon receiving the malformed command. There is no impact on confidentiality or integrity — the vulnerability is purely a denial-of-service issue. Repeated exploitation could prevent legitimate FTP clients from connecting, disrupting file transfer operations dependent on the affected server (GitHub Advisory, VulnCheck).

A public proof-of-concept exploit is available on Exploit-DB (EDB-46532), implemented as a Python script that demonstrates the crash by sending an oversized PBSZ command. There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.043% (0.000430), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Exploit-DB, GitHub Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible Core FTP Server instances running version 2.0 build 653 using port scanning tools (e.g., Nmap targeting TCP port 21).
2. Connect to FTP server: Establish a TCP connection to the FTP server on port 21 — no authentication is required to send the PBSZ command.
3. Craft malicious PBSZ command: Prepare a PBSZ command with a payload buffer exceeding 211 bytes (e.g., PBSZ followed by 212 or more 'A' characters).
4. Send the malformed command: Transmit the oversized PBSZ command to the server. The server fails to properly validate the buffer size, triggering an access violation.
5. Crash the server: The Core FTP server process crashes, resulting in a denial of service for all connected and future clients (Exploit-DB, GitHub Advisory).

• Network: Unexpected TCP connections to FTP port 21 from unknown or untrusted IP addresses; FTP sessions that send a PBSZ command immediately without completing authentication.
• Logs: FTP server access logs showing PBSZ commands with unusually large argument strings (>211 bytes) from external or unexpected sources; abrupt session termination entries following a PBSZ command.
• Process: Sudden termination or crash of the Core FTP server process (e.g., CoreFTPServer.exe disappearing from the process list); Windows Event Log entries indicating an application crash or access violation for the Core FTP server process.

The primary remediation is to update Core FTP Server to a version newer than 2.0 build 653, as the vendor has released a patch (VulnCheck). As a network-level workaround, restrict access to the FTP server (TCP port 21) to trusted IP addresses only using firewall rules, reducing the attack surface for unauthenticated exploitation. Additionally, monitor FTP server logs for PBSZ commands with abnormally large payloads as a detection measure (GitHub Advisory).

The vulnerability received limited public attention, with coverage primarily from automated vulnerability tracking platforms and security databases. A technical write-up was published at infinitsec.net shortly after the CVE was disclosed in April 2026. No significant vendor statements, notable researcher commentary, or widespread media coverage have been identified beyond standard vulnerability database entries (GitHub Advisory).