CVE-2004-1626: Ability Server STOR command buffer overflow allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityNetwork-reachable, unauthenticated buffer overflow with public exploit references and very high EPSS, though no KEV listing and only a medium CVSS 2.0 score.

What it is

Ability Server 2.34 (and possibly other versions) contains a buffer overflow in its handling of the STOR command. A remote attacker can send an overly long STOR argument to corrupt memory and potentially execute arbitrary code on the FTP service. The flaw matters because it is network-reachable and requires no authentication.

Impact

An attacker can crash the service or, if the overflow is successfully shaped, execute arbitrary code with the privileges of the Ability Server process. The CVSS 2.0 vector scores only partial availability impact, so the record understates the potential for code execution.

Attack surface

Reached over the network via the FTP service by sending a crafted STOR command; the CVSS vector AV:N/AC:L/Au:N indicates no authentication is required. No user interaction is described.

Exploitation

CISA KEV does not list this CVE, but EPSS is 0.67387 (99.27th percentile) and multiple references are tagged Exploit, indicating public exploit material exists.

What to do

• Patch or upgrade Ability Server to a version that fixes the STOR buffer overflow; if no fixed version is available, retire or replace the product.
• Restrict network access to the FTP service to trusted hosts and block it from the internet.
• Run the service under a low-privilege account and isolate it from sensitive data and systems.
• Enforce strict input length limits on FTP commands at a proxy or WAF where feasible.
• Monitor vendor and CERT/CC advisories for updated guidance on Ability Server.

Detection

• Inspect FTP server logs for STOR commands with abnormally long arguments or malformed syntax.
• Alert on crashes or restarts of the Ability Server process.
• Monitor for unexpected child processes or outbound connections spawned by the FTP service.
• Use network IDS signatures for FTP STOR buffer overflow attempts against Ability Server.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.