Core FTP LE 2.2 - Denial of Service | Advisories

Advisories

Core FTP LE 2.2 - Denial of Service

severity: high
date: 2/6/2026
Affecting: Core FTP LE <= 2.2 build 1947
CVE: CVE-2020-37107
CWE: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CVSS: 6.7
CVSS V4 Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
References: ExploitDB-48137
Core FTP Vendor Homepage
Core FTP Download Page
Credit: Ismael Nava
Description: Core FTP LE 2.2 contains a denial of service vulnerability that allows attackers to crash the application by overwriting the account field with a large buffer. Attackers can create a text file with 20,000 repeated characters and paste it into the account field to cause the application to become unresponsive and require reinstallation.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo