A buffer overflow vulnerability in Core FTP/SFTP Server allows unauthenticated attackers to cause a denial of service by triggering an application crash.

The application is susceptible to a buffer overflow (CWE-787) when processing user input in the User domain configuration field. An unauthenticated attacker can supply a malicious payload of approximately 7000 bytes, which leads to an out of bounds write and results in an immediate service crash.

Successful exploitation of this vulnerability results in a denial of service, effectively taking the file server offline. This can disrupt critical business operations that rely on secure file transfers, leading to potential productivity loss and service downtime. Given the CVSS score of 7.5, this high severity flaw warrants immediate attention to ensure system availability.

Immediate Action: Since no official patch is currently identified, administrators should restrict access to the server management interface to trusted internal networks only.

Proactive Monitoring: Monitor system logs for repeated service crashes or unusual spikes in memory usage associated with the Core FTP process.

Compensating Controls: Deploy a Web Application Firewall or an intrusion prevention system to filter and block excessively long input strings directed at the management interface.

Public Exploit Available: Yes, a proof of concept is available via the Exploit Database (EDB-ID: 46371).

This vulnerability presents a clear risk to service availability through a well documented denial of service mechanism. Organizations utilizing Core FTP/SFTP Server should prioritize limiting access to the management console and monitor for any vendor updates that may address this buffer overflow. Mitigating this risk is essential to prevent unauthorized service disruption.