TFTP is a simple file-transfer utility that operates across embedded systems, network devices, and legacy infrastructure where minimal protocol overhead is required, presenting a narrow but persistent product scope. The recurring vulnerability signal centers on input-validation and memory-boundary issues characteristic of a lightweight protocol implementation, alongside instances classified as other weakness categories in the NVD. Current exploitation activity and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Tftp over time
Signals from CVEs in this vendor scope (4 CVEs).
4 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2008-2161HIGH Buffer overflow in TFTP Server SP 1.4 and 1.5 on Windows, and possibly other versions, allows remote attackers to execute arbitrary code via a long TFTP error packet. NOTE: some o | May 12, 2008 | 10.0 | 81 | NO | YES |
CVE-2004-1485HIGH Buffer overflow in the TFTP client in InetUtils 1.4.2 allows remote malicious DNS servers to execute arbitrary code via a large DNS response that is handled by the gethostbyname fu | Dec 31, 2004 | 7.5 | 25 | NO | NO |
CVE-1999-0183MEDIUM Linux implementations of TFTP would allow access to files outside the restricted directory. | Sep 1, 1997 | 6.4 | 17 | NO | NO |
CVE-2002-2237MEDIUM tftp32 TFTP server 2.21 and earlier allows remote attackers to cause a denial of service via a GET request with a DOS device name such as com1 or aux. | Dec 31, 2002 | 5.0 | 15 | NO | NO |
Signals from CVEs in this vendor scope (4 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Tftp.
Media articles that mention a CVE ID that affects a product developed by Tftp — matched by CVE ID, not by vendor name.