CVE-2006-6184: Allied Telesyn AT-TFTP stack buffer overflow via long filename

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityCVSS 2.0 score of 10 with remote, unauthenticated code execution potential and public exploit references, though no confirmed in-the-wild activity is listed.

What it is

Allied Telesyn TFTP Server (AT-TFTP) 1.9 and possibly earlier contains multiple stack-based buffer overflows triggered by a long filename in GET or PUT commands. A remote, unauthenticated attacker can crash the service or potentially execute arbitrary code. The flaw is remotely reachable over the network with no authentication or user interaction required.

Impact

An attacker can cause a denial of service by crashing the TFTP service, or potentially execute arbitrary code with the privileges of the AT-TFTP process. Successful code execution would give the attacker control over the affected host or service.

Attack surface

The vulnerability is reached over the network via TFTP GET or PUT requests containing an overly long filename. No authentication or user interaction is required, as indicated by the CVSS vector AV:N/AC:L/Au:N.

Exploitation

Exploit code is publicly referenced (SecurityFocus BID 21320 tagged Exploit, plus Exploit-DB entries), and EPSS indicates a high 30-day exploitation probability (0.65866, 99.2nd percentile). The CVE is not listed in CISA KEV, so no confirmed in-the-wild exploitation is documented in this record.

What to do

• Apply the vendor patch or upgrade AT-TFTP to a fixed version if available; consult the Allied Telesyn advisory referenced in the record.
• If no patch is available, restrict TFTP access to trusted hosts via firewall rules or network ACLs, and disable the service where not needed.
• Run AT-TFTP with least privilege and isolate it from sensitive systems to limit the impact of potential code execution.
• Monitor for and block oversized or malformed TFTP filenames at network boundaries where feasible.

Detection

• Inspect TFTP traffic for unusually long filenames in GET or PUT requests that exceed expected length limits.
• Monitor AT-TFTP process crashes or unexpected restarts in system or application logs.
• Watch for anomalous outbound connections or process behavior from the host running AT-TFTP that could indicate code execution.
• Use network IDS/IPS signatures for known AT-TFTP buffer overflow exploit patterns if available.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.