CVE-2019-25686

Core FTP 2.0 build 653 PBSZ Unauthenticated Denial of Service

CVSS 8.7 HIGHEPSS 0.5%CWE-306

Vexday Risk Score

41Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 8.7EPSS 0.5%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

05 Apr 2026Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

Core FTP 2.0 build 653 contains a denial of service vulnerability in the PBSZ command that allows unauthenticated attackers to crash the service by sending a malformed command with an oversized buffer. Attackers can send a PBSZ command with a payload exceeding 211 bytes to trigger an access violation and crash the FTP server process.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected products

Coreftp · Core FTP

public PoCs found — 1

cve_referencewww.exploit-db.com/exploits/46532unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://coreftp.com/server/download/archive/CoreFTPServer653.exe https://www.exploit-db.com/exploits/46532 https://www.vulncheck.com/advisories/core-ftp-build-653-pbsz-unauthenticated-denial-of-service http://www.coreftp.com/