PT-2026-30374 · Nico Ftp · Nicoftp

Published 2026-04-04 · Updated 2026-04-27 · CVE-2018-25254

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NICO-FTP version 3.0.1.19

Description A structured exception handler (SEH) buffer overflow allows remote attackers to execute arbitrary code by sending crafted FTP commands. Attackers can connect to the FTP service and send oversized data in response handlers to overwrite SEH pointers and redirect execution to injected shellcode. SEH is a mechanism for handling hardware and software exceptions in Windows applications.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2018-25254

Affected Products

Nicoftp

References · 5

• 🔥 https://exploit-db.com/exploits/45442 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-25254 · Security Note
• https://vulncheck.com/advisories/nico-ftp-buffer-overflow-seh · Note
• https://en.softonic.com/download/nico-ftp/windows/post-download · Note
• https://t.me/cveNotify/161070 · Telegram Post