cbcvebase.
CVE-2018-12113
published 2018-07-05

CVE-2018-12113: Core FTP LE version 2.2 Build 1921 is prone to a buffer overflow vulnerability that may result in a DoS or remote code execution via a PASV response.

PriorityP264critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
6.95%
93.3th percentile
Core FTP LE version 2.2 Build 1921 is prone to a buffer overflow vulnerability that may result in a DoS or remote code execution via a PASV response.

Affected

1 ranges
VendorProductVersion rangeFixed in
coreftpcore_ftp——

Detection & IOCsextracted from sources · hover to see the quote

versionCore FTP LE v2.2 Build 1921↗
command227 Entering Passive Mode (<3004-byte overflow buffer>)↗
bytes↗
\x90 * 3004 (NOP sled, 3004 bytes) in PASV response payload
  • →A rogue FTP server sending a malformed PASV (227) response with an oversized payload (≥3004 bytes) in the parenthesised address field is the trigger for this vulnerability. Monitor FTP clients connecting to untrusted servers and inspect 227 responses for abnormally large bodies. ↗
  • →The overflow is triggered specifically by the PASV response from a server; defenders should alert on Core FTP LE processes (coreftp.exe) crashing or spawning unexpected child processes after receiving a 227 response. ↗
  • →The PoC uses a NOP sled of exactly 3004 bytes as the overflow buffer. A network signature matching a 227 FTP response line whose parenthesised field exceeds ~3000 bytes is a strong indicator of exploitation attempts. ↗
  • ·The PoC binds a fake FTP server on all interfaces (0.0.0.0:21); exploitation requires the victim Core FTP LE client to connect to the attacker-controlled server, making this a client-side / rogue-server attack rather than a remotely exploitable server vulnerability. ↗
  • ·The PoC was tested only on Windows 10 and is categorised as DoS; remote code execution potential is noted in the NVD description but not demonstrated in the published exploit. ↗

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.