A stack-based buffer overflow in ZOC Terminal 7.25.5 allows a local attacker to crash the application, resulting in a denial of service condition.

This vulnerability is a stack-based buffer overflow (CWE-121) triggered when a user inputs an excessively long string into the private key file field. The application fails to properly validate the input size, allowing a 2000-byte buffer to overwrite memory and cause the application to become unresponsive.

The primary impact of this vulnerability is the loss of availability for the ZOC Terminal application. While the CVSS score of 7.5 indicates a high severity, the requirement for local interaction limits the scope of the threat. Unexpected application crashes can disrupt workflows and administrative tasks that rely on secure shell connectivity, potentially impacting operational efficiency.

Immediate Action: Update to the latest version of ZOC Terminal, as the vendor has addressed the memory handling flaw in subsequent releases.

Proactive Monitoring: Review system logs for signs of application instability or frequent service restarts associated with the ZOC Terminal process.

Compensating Controls: Ensure that users are trained to avoid pasting untrusted or malformed data into application input fields, which serves as a basic defense against manual exploitation attempts.

Public Exploit Available: Yes, a proof-of-concept exploit is available via the Exploit Database (EDB-ID: 48292).

Organizations utilizing ZOC Terminal 7.25.5 should prioritize upgrading to a patched version to eliminate this denial of service risk. Although exploitation requires local access, the availability of a public proof-of-concept lowers the barrier for potential attackers to disrupt critical terminal operations. Immediate patching remains the most effective method to ensure application stability and security.