CVE-2018-25254

critical · 9.3

NICO-FTP 3.0.1.19 contains a structured exception handler buffer overflow vulnerability that allows remote attackers to execute arbitrary code by sending crafted FTP commands. Attackers can connect to the FTP service and send oversized data in response handlers to overwrite SEH pointers and redirect execution to injected shellcode.

9.3

CVSS

0.9%

EPSS (exploit prob.)

59th

EPSS percentile

2026-04-04

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-787

Affected products

Vendor	Product	Affected versions
nico-ftp_project	nico-ftp	<= 3.0.1.19

Check a specific version with /api/v1/cve/match.

References

https://en.softonic.com/download/nico-ftp/windows/post-download
https://www.exploit-db.com/exploits/45442
https://www.vulncheck.com/advisories/nico-ftp-buffer-overflow-seh

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2018-25254