CVE-2019-25607

Axessh 4.2 Local Stack-based Buffer Overflow via Log File Name

High8.6EPSS 0.15%

Published: 22 Mar 2026
Updated: 23 Mar 2026
Reserved: 22 Mar 2026
Assigned by: VulnCheck

Description

Axessh 4.2 contains a stack-based buffer overflow vulnerability in the log file name field that allows local attackers to execute arbitrary code by supplying an excessively long filename. Attackers can overflow the buffer at offset 214 bytes to overwrite the instruction pointer and execute shellcode with system privileges.

Scores

CVSS scores of CVE-2019-25607, by who scored it
Scored by	CVSS	Score	Vector
VulnCheckCNA (assigner)	4.0	High8.6	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
VulnCheckCNA (assigner)	3.1	High8.4	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Deferred	4.0	High8.6	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.15% · top 95% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.6.

Weakness

CWE-787: Out-of-bounds Write (opens in a new tab)All about CWE-787 and its CVEs

Affected products

Labf · Axessh
- affected 4.2

References (6)

ExploitDB-46922 (opens in a new tab)exploit
Official Product Homepage (opens in a new tab)product
Product Reference (opens in a new tab)product
Exploit DB (opens in a new tab)exploit
Exploit DB (opens in a new tab)exploit
VulnCheck Advisory: Axessh 4.2 Local Stack-based Buffer Overflow via Log File Name (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2019-25607](https://trackcve.app/badge/CVE-2019-25607.svg)](https://trackcve.app/cve/CVE-2019-25607)

Record last updated 23 Mar 2026, 16:16 UTC.