Vulnerability · Published Jul 15, 2025 · Assigned by VulnCheck
CVE-2025-34107WinaXe 7.7 FTP Client Remote Buffer Overflow
High 8.7
In plain English
A high-severity stack buffer overflow in WinaXe FTP Client from LabF. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit.
Official description
A buffer overflow vulnerability exists in the WinaXe FTP Client version 7.7 within the FTP banner parsing functionality, WCMDPA10.dll. When the client connects to a remote FTP server and receives an overly long '220 Server Ready' response, the vulnerable component responsible for parsing the banner overflows a stack buffer, leading to arbitrary code execution under the context of the user.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| LabF | WinaXe FTP Client | 7.7 |
Weakness: CWE-121 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/ftp/winaxe_server_ready.rb exploit
- http://hyp3rlinx.altervista.org/advisories/WINAXE-FTP-CLIENT-REMOTE-BUFFER-OVERFLOW.txt third-party-advisory, exploit
- https://www.exploit-db.com/exploits/40767 exploit
- https://www.vulncheck.com/advisories/wina-xe-ftp-client-remote-buffer-overflow third-party-advisory