PT-2026-7601 · Unknown · Blackmoon Ftp Server

Debashis Pal · Published 2026-02-11 · Updated 2026-02-11 · CVE-2019-25306

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BlackMoon FTP Server version 3.1.2.1731

Description BlackMoon FTP Server version 3.1.2.1731 contains an unquoted service path issue that may allow local users to execute code with elevated system privileges. An attacker can exploit the unquoted binary path within the service configuration to insert malicious code. This malicious code would then execute with LocalSystem account permissions when the service starts.

Recommendations Apply appropriate quoting to the service path configuration to prevent the execution of unauthorized code.

Exploit

Fix

Weakness Enumeration

CWE-428

Related Identifiers

CVE-2019-25306

Affected Products

Blackmoon Ftp Server

References · 5

• 🔥 https://exploit-db.com/exploits/47521 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25306 · Security Note
• https://vulncheck.com/advisories/blackmoon-ftp-server-bmftp-release-unquoted-serive-path · Note
• https://t.me/CVEtracker/44420 · Telegram Post
• http://tucows.com/preview/222822/BlackMoon-FTP-Server?q=FTP+server · Note