Disk Pulse Enterprise 9.0.34 Login Stack Buffer Overflow
Vulnerability Description
A stack-based buffer overflow vulnerability exists in the login functionality of Disk Pulse Enterprise version 9.0.34. An attacker can send a specially crafted HTTP POST request to the /login endpoint with an overly long username parameter, causing a buffer overflow in the libspp.dll component. Successful exploitation allows arbitrary code execution with SYSTEM privileges.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-34108
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Tulpa Security
References
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/disk_pulse_enterprise_bof.rb
- https://www.exploit-db.com/exploits/40452
- https://vulners.com/metasploit/MSF:EXPLOIT-WINDOWS-HTTP-DISK_PULSE_ENTERPRISE_BOF-
- https://advisories.checkpoint.com/defense/advisories/public/2017/cpai-2017-0006.html/
- https://www.vulncheck.com/advisories/disk-pulse-enterprise-login-stack-buffer-overflow
Affected Vendor
Falconstor Software
View all reports →