WinaXe 7.7 FTP Client Remote Buffer Overflow
Vulnerability Description
A buffer overflow vulnerability exists in the WinaXe FTP Client version 7.7 within the FTP banner parsing functionality, WCMDPA10.dll. When the client connects to a remote FTP server and receives an overly long '220 Server Ready' response, the vulnerable component responsible for parsing the banner overflows a stack buffer, leading to arbitrary code execution under the context of the user.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-34107
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- hyp3rlinx
References
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/ftp/winaxe_server_ready.rb
- http://hyp3rlinx.altervista.org/advisories/WINAXE-FTP-CLIENT-REMOTE-BUFFER-OVERFLOW.txt
- https://www.exploit-db.com/exploits/40767
- https://www.vulncheck.com/advisories/wina-xe-ftp-client-remote-buffer-overflow
Affected Vendor
LabF
View all reports →