


Perceptive Security
SOC/SIEM Consultancy

Core FTP 2.0 build 653 contains a denial of service vulnerability in the PBSZ command that allows unauthenticated attackers to crash the service by sending a ma…
Published:
4 April 2026 at 22:00:00
Alert date:
5 April 2026 at 22:09:04
Source:
nvd.nist.gov
Network Infrastructure
Core FTP 2.0 build 653 contains a denial of service vulnerability in the PBSZ command that allows unauthenticated attackers to crash the FTP server. The vulnerability is triggered when attackers send a PBSZ command with a payload exceeding 211 bytes, causing an access violation and crashing the server process. This is a buffer overflow vulnerability that does not require authentication to exploit. The vulnerability affects Core FTP Server version 2.0 build 653 specifically. Exploitation results in service disruption through process crashes.
Technical details
Mitigation steps:
Affected products:
Core FTP
Related links:
https://nvd.nist.gov/vuln/detail/CVE-2019-25686
http://coreftp.com/server/download/archive/CoreFTPServer653.exe
http://www.coreftp.com/
https://www.exploit-db.com/exploits/46532
https://www.vulncheck.com/advisories/core-ftp-build-653-pbsz-unauthenticated-denial-of-service
Related CVE's:
Related threat actors:
IOC's:
This article was created with the assistance of AI technology by Perceptive.
