Cerberus Ftp Server
Monthly
Authenticated users of Cerberus FTP Server (all releases prior to 2026.3.0) can supply a UNC/SMB path such as \\attacker-host\share into a parameter that accepts path values, causing the service to initiate an outbound SMB authentication and thereby leak the Cerberus service account's Net-NTLMv2 hash to an attacker-controlled listener. Impact is credential exposure rather than code execution: confidentiality is rated high while integrity and availability are unaffected, and the assessed vector requires an existing authenticated session (PR:L) with no user interaction. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; exploitation additionally depends on the server being permitted to reach the attacker over outbound TCP 139/445, so the practical risk is moderate and environment-dependent.
Local privilege escalation in Cerberus FTP Server on Windows (all builds through 2025.4.2) lets a low-privileged local user leverage insecurely preserved inherited filesystem permissions to gain higher privileges on the host. The SSVC framework records a proof-of-concept exploit (published by Reversec Labs) with total technical impact, though EPSS estimates real-world exploitation probability at just 0.01%. The issue is fixed in release 2026.1.
Buffer overflow in Cerberus FTP Server 8.0.10.3 allows remote attackers to cause a denial of service (daemon crash) or possibly have unspecified other impact via a long MLST command. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Authenticated users of Cerberus FTP Server (all releases prior to 2026.3.0) can supply a UNC/SMB path such as \\attacker-host\share into a parameter that accepts path values, causing the service to initiate an outbound SMB authentication and thereby leak the Cerberus service account's Net-NTLMv2 hash to an attacker-controlled listener. Impact is credential exposure rather than code execution: confidentiality is rated high while integrity and availability are unaffected, and the assessed vector requires an existing authenticated session (PR:L) with no user interaction. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; exploitation additionally depends on the server being permitted to reach the attacker over outbound TCP 139/445, so the practical risk is moderate and environment-dependent.
Local privilege escalation in Cerberus FTP Server on Windows (all builds through 2025.4.2) lets a low-privileged local user leverage insecurely preserved inherited filesystem permissions to gain higher privileges on the host. The SSVC framework records a proof-of-concept exploit (published by Reversec Labs) with total technical impact, though EPSS estimates real-world exploitation probability at just 0.01%. The issue is fixed in release 2026.1.
Buffer overflow in Cerberus FTP Server 8.0.10.3 allows remote attackers to cause a denial of service (daemon crash) or possibly have unspecified other impact via a long MLST command. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.