Core FTP Lite 1.3 - Denial of Service (PoC)

Core FTP Lite 1.3 contains a buffer overflow vulnerability in the username input field that allows attackers to crash the application by supplying oversized input. Attackers can generate a 7000-byte payload of repeated 'A' characters to trigger an application crash without requiring additional interaction.

Problem type

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Affected products

Core FTP

Core FTP Lite

1.3c Build 1437 - AFFECTED

References

ExploitDB-48100

https://www.exploit-db.com/exploits/48100

exploit

Core FTP Official Homepage

http://www.coreftp.com/

product

VulnCheck Advisory: Core FTP Lite 1.3 - Denial of Service (PoC)

https://www.vulncheck.com/advisories/core-ftp-lite-denial-of-service-poc

third-party-advisory

GitHub Security Advisories

GHSA-39mx-hmw6-9hmp

Core FTP Lite 1.3 contains a buffer overflow vulnerability in the username input field that...

https://github.com/advisories/GHSA-39mx-hmw6-9hmp

nvd.nist.gov

https://nvd.nist.gov/vuln/detail/CVE-2020-37155

exploit-db.com

https://www.exploit-db.com/exploits/48100

vulncheck.com

https://www.vulncheck.com/advisories/core-ftp-lite-denial-of-service-poc

coreftp.com

http://www.coreftp.com

github.com

https://github.com/advisories/GHSA-39mx-hmw6-9hmp

JSON source

https://cveawg.mitre.org/api/cve/CVE-2020-37155

Click to expand

{
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "cveMetadata": {
    "cveId": "CVE-2020-37155",
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "dateUpdated": "2026-02-06T23:14:09.188Z",
    "dateReserved": "2026-02-03T16:27:45.310Z",
    "datePublished": "2026-02-06T23:14:09.188Z",
    "state": "PUBLISHED"
  },
  "containers": {
    "cna": {
      "providerMetadata": {
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck",
        "dateUpdated": "2026-02-06T23:14:09.188Z"
      },
      "datePublic": "2020-02-20T00:00:00.000Z",
      "title": "Core FTP Lite 1.3 - Denial of Service (PoC)",
      "descriptions": [
        {
          "lang": "en",
          "value": "Core FTP Lite 1.3 contains a buffer overflow vulnerability in the username input field that allows attackers to crash the application by supplying oversized input. Attackers can generate a 7000-byte payload of repeated 'A' characters to trigger an application crash without requiring additional interaction."
        }
      ],
      "affected": [
        {
          "vendor": "Core FTP",
          "product": "Core FTP Lite",
          "versions": [
            {
              "version": "1.3c Build 1437",
              "status": "affected"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "lang": "en",
              "description": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')",
              "cweId": "CWE-120",
              "type": "CWE"
            }
          ]
        }
      ],
      "references": [
        {
          "url": "https://www.exploit-db.com/exploits/48100",
          "name": "ExploitDB-48100",
          "tags": [
            "exploit"
          ]
        },
        {
          "url": "http://www.coreftp.com/",
          "name": "Core FTP Official Homepage",
          "tags": [
            "product"
          ]
        },
        {
          "url": "https://www.vulncheck.com/advisories/core-ftp-lite-denial-of-service-poc",
          "name": "VulnCheck Advisory: Core FTP Lite 1.3 - Denial of Service (PoC)",
          "tags": [
            "third-party-advisory"
          ]
        }
      ],
      "metrics": [
        {
          "format": "CVSS"
        },
        {
          "format": "CVSS",
          "cvssV3_1": {
            "version": "3.1",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "NONE",
            "scope": "UNCHANGED",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH"
          }
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Berat Isler",
          "type": "finder"
        }
      ]
    }
  }
}