CVE-2019-25711

SpotFTP Password Recover version 2.4.2 is affected by a denial of service vulnerability triggered by improper buffer handling in the application's Name field during user registration. An attacker can supply a 256-byte payload to crash the application, rendering it temporarily unavailable. This vulnerability is classified as MEDIUM severity with a CVSS score of 5.5, as it requires local access and user interaction but results in high availability impact. The attack is relatively low complexity to execute, requiring only local access to the system and the ability to interact with the application interface. No special privileges are required beyond standard user-level access, making it accessible to low-privileged threat actors. The impact is limited to denial of service with no confidentiality or integrity consequences. There is no evidence of active exploitation in the wild, with the CVE absent from the Known Exploited Vulnerabilities (KEV) catalog and demonstrating extremely low exploitation probability at 0.0009 percent. No public exploit code is readily available, and community attention remains minimal. Organizations using SpotFTP Password Recover 2.4.2 should prioritize updating to a patched version but may deprioritize this vulnerability relative to higher-severity threats.