CVE-2022-50689

Cobian Reflector 0.9.93 RC1 Local Denial of Service via Password Field

State: Published
Severity: 6.9 Medium
Published: Dec 22, 2025
Updated: Dec 22, 2025
Reserved: Dec 21, 2025

Description

Cobian Reflector 0.9.93 RC1 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the password input field. Attackers can paste a large 8000-byte buffer into the password field to trigger an application crash during SFTP task configuration.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N	VulnCheck
3.1	6.2 Medium	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	VulnCheck

Weaknesses

CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Affected Products

Product	Versions
Cobian ReflectorCobiansoft	0.9.93Affected

References

ExploitDB-50789exploit
Cobian Software Official Homepageproduct
VulnCheck Advisory: Cobian Reflector 0.9.93 RC1 Local Denial of Service via Password Fieldthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.