A buffer overflow vulnerability in Core FTP LE 2.2 allows an attacker to cause a permanent application crash, resulting in a denial of service that requires software reinstallation.

The application is susceptible to a classic buffer overflow (CWE-120) because it fails to perform bounds checking on the account input field. An attacker can crash the application by injecting a large buffer, specifically 20,000 repeated characters, into the account field during the connection configuration process.

Successful exploitation results in a persistent denial of service. Because the application fails to restart properly after the crash, the software must be manually uninstalled and reinstalled to restore functionality. This leads to operational downtime and potential loss of productivity for users relying on the application for file transfer tasks. While the CVSS score is 7.5, the impact is primarily availability focused.

Immediate Action: As there is no official patch available from the vendor, users should restrict access to the application and avoid entering untrusted or excessively long strings into the account configuration field.

Proactive Monitoring: Security teams should monitor system logs and endpoint stability for recurring application crashes or unexpected terminations of the Core FTP LE process.

Compensating Controls: Ensure the application is deployed within a secure environment where only authorized personnel can access the configuration settings to mitigate the risk of local exploitation.

Public Exploit Available: Yes, a published proof of concept exists via the Exploit-DB entry (EDB-ID 48137).

Given the lack of a vendor-provided patch, users should consider migrating to a supported and actively maintained file transfer client to eliminate this risk. If the software must remain in use, enforce strict administrative controls over the local workstation to prevent unauthorized users from manipulating the vulnerable configuration parameters.