CVE-2019-25607
Axessh 4.2 Local Stack-based Buffer Overflow via Log File Name
- State
- Published
- Severity
- 8.6 High
- Published
- Mar 22, 2026
- Updated
- Mar 23, 2026
- Reserved
- Mar 22, 2026
Description
Axessh 4.2 contains a stack-based buffer overflow vulnerability in the log file name field that allows local attackers to execute arbitrary code by supplying an excessively long filename. Attackers can overflow the buffer at offset 214 bytes to overwrite the instruction pointer and execute shellcode with system privileges.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.6 High | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.4 High | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-787 Out-of-bounds Write
Affected Products
| Product | Versions |
|---|---|
AxesshLabf |
|
References
- ExploitDB-46922exploit
- Official Product Homepageproduct
- Product Referenceproduct
- Exploit DBexploit
- Exploit DBexploit
- VulnCheck Advisory: Axessh 4.2 Local Stack-based Buffer Overflow via Log File Namethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.