What is the CVSS score of CVE-2019-25357?

CVE-2019-25357 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Windows are affected by CVE-2019-25357?

Control Center PRO 6.2.9 is vulnerable to a stack-based buffer overflow that could allow attackers to execute arbitrary code through the user creation module.

Is there a public PoC exploit available for CVE-2019-25357?

Yes, a public proof-of-concept exploit is available for CVE-2019-25357. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2019-25357?

Within 24 hours: Inventory all instances of Control Center PRO 6.2.9 in production and development environments. Restrict administrative access to user creation functionality and disable remote access where possible. Within 7 days: Implement network segmentation to isolate affected systems and deploy Web Application Firewall (WAF) rules to block malicious payloads targeting the username field. Within 30 days: Evaluate migration to a supported version, contact vendor for security advisories, and conduct vulnerability scanning of affected systems for signs of exploitation.

Windows CVE-2019-25357

HIGH

Stack-based Buffer Overflow (CWE-121)

2026-02-18 disclosure@vulncheck.com

Windows Buffer Overflow Stack Overflow

8.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Feb 19, 2026 - 15:53 vuln.today

Public exploit code

CVE Published

Feb 18, 2026 - 22:16 nvd

HIGH 8.4

DescriptionCVE.org

Control Center PRO 6.2.9 contains a stack-based buffer overflow vulnerability in the user creation module's username field that allows attackers to overwrite Structured Exception Handler (SEH). Attackers can craft a malicious payload exceeding 664 bytes to inject shellcode and potentially execute arbitrary code on vulnerable Windows systems.

AnalysisAI

Technical ContextAI

Classified as CWE-121 (Stack-based Buffer Overflow). Control Center PRO 6.2.9 contains a stack-based buffer overflow vulnerability in the user creation module's username field that allows attackers to overwrite Structured Exception Handler (SEH). Attackers can craft a malicious payload exceeding 664 bytes to inject shellcode and potentially execute arbitrary code on vulnerable Windows systems.