CVE-2019-19782

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The FTP client in AceaXe Plus 1.0 allows a buffer overflow via a long EHLO response from an FTP server.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/sketler/sketler.github.io/blob/master/_posts/2019-11-11-AceaXeftp-RCE-Via-Buffer-Overflow.markdownExploit, Third Party Advisory
https://sketler.github.io/cve_research/AceaXeftp-RCE-Via-Buffer-Overflow/Exploit, Third Party Advisory
https://github.com/sketler/sketler.github.io/blob/master/_posts/2019-11-11-AceaXeftp-RCE-Via-Buffer-Overflow.markdownExploit, Third Party Advisory
https://sketler.github.io/cve_research/AceaXeftp-RCE-Via-Buffer-Overflow/Exploit, Third Party Advisory

Timeline

Published: Dec 13, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-197836.5An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8. If sieve script uploading is allowed (3.x CVE-2019-197857.8ATasm 1.06 has a stack-based buffer overflow in the to_comma() function in asm.c via a crafted .m65 file.CVE-2019-197867.8ATasm 1.06 has a stack-based buffer overflow in the parse_expr() function in setparse.c via a crafted .m65 file.CVE-2019-197877.8ATasm 1.06 has a stack-based buffer overflow in the get_signed_expression() function in setparse.c via a crafted .m65 file.CVE-2019-197885.5Opera for Android before 54.0.2669.49432 is vulnerable to a sandboxed cross-origin iframe bypass attack. By using a service working inside a CVE-2019-197896.53S-Smart CODESYS SP Realtime NT before V2.3.7.28, CODESYS Runtime Toolkit 32 bit full before V2.4.7.54, and CODESYS PLCWinNT before V2.4.7.5 CVE-2019-197909.8Path traversal in RadChart in Telerik UI for ASP.NET AJAX allows a remote attacker to read and delete an image with extension .BMP, .EXIF, .CVE-2019-197919.8In LemonLDAP::NG (aka lemonldap-ng) before 2.0.7, the default Apache HTTP Server configuration does not properly restrict access to SOAP/RES CVE-2019-197926.7A permissions issue in ESET Cyber Security before 6.8.300.0 for macOS allows a local attacker to escalate privileges by appending data to ro CVE-2019-197938.8In Cyxtera AppGate SDP Client 4.1.x through 4.3.x before 4.3.2 on Windows, a local or remote user from the same domain can gain privileges.CVE-2019-197945.9The miekg Go DNS package before 1.1.25, as used in CoreDNS before 1.6.6 and other products, improperly generates random numbers because math CVE-2019-197957.8samurai 0.7 has a heap-based buffer overflow in canonpath in util.c via a crafted build file.