FTP Navigator 8.03 - Stack Overflow (SEH)
Priority HIGH 78CWE-121Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.
Summary
FTP Navigator 8.03 contains a stack overflow vulnerability that allows attackers to execute arbitrary code by overwriting Structured Exception Handler (SEH) registers. Attackers can craft a malicious payload that triggers a buffer overflow when pasted into the Custom Command textbox, enabling remote code execution and launching the calculator as proof of concept.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00776 56th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by the CNA and NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Softpedia | FTP Navigator | 8.03 | — | No fix listed | CNA |
- FTP Navigator VendorSoftpedia Affected 8.03 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:internet-soft:ftp_navigator:*:*:*:*:*:*:*:* | up to 8.03 | Vulnerable | Internet-Soft |
- cpe:2.3:a:internet-soft:ftp_navigator:*:*:*:*:*:*:*:* Versions up to 8.03 Vulnerable ·Internet-Soft
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-25321
- 2026-10-03 Alias added: GHSA-mg52-9q5r-pwrf
References
Exploit 2
Other 1
More Softpedia vulnerabilities
- TI-2007-05115 PHP remote file inclusion vulnerability in common.php in LiveAlbum 0.9.0, when… CVSS 2.0MEDIUM 6.8
- TI-2008-00351 PHP remote file inclusion vulnerability in inc/linkbar.php in Small Axe Weblog 0.3.1… CVSS 2.0MEDIUM 6.8
- TI-2008-01966 Cross-site scripting (XSS) vulnerability in index.php in Softpedia SiteXS CMS 0.1.1… CVSS 2.0MEDIUM 4.3
Sources
- CVE-2019-25321 · CVE Program
- CVE-2019-25321 · NVD
- FIRST EPSS
- GHSA-mg52-9q5r-pwrf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences