CVE-2018-9059: Easy File Sharing Web Server login buffer overflow allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with no authentication or interaction required, public exploit code, and very high EPSS make this an urgent remote code execution risk for any exposed instance.

What it is

Easy File Sharing (EFS) Web Server 7.2 contains a stack-based buffer overflow reachable through a malicious login request to forum.ghp. A remote, unauthenticated attacker can trigger the overflow and potentially execute arbitrary code on the host. The record notes this may overlap CVE-2014-3791, so the exact affected version scope is uncertain.

Impact

Successful exploitation gives the attacker arbitrary code execution in the context of the web server process, which typically means full control of the host. That enables data theft, service disruption, or use of the machine as a foothold for further attacks.

Attack surface

The flaw is reached over the network via an HTTP login request to forum.ghp; the CVSS vector indicates no privileges and no user interaction are required. Any internet- or network-exposed instance of the affected server is directly reachable.

Exploitation

CVE-2018-9059 is not listed in CISA KEV, but EPSS is very high (0.7694, 99.5th percentile) and public exploit code exists in Exploit-DB and Packet Storm references. This indicates active interest and readily available proof-of-concept exploitation.

What to do

• Patch or upgrade Easy File Sharing Web Server beyond 7.2; if no fixed release exists, migrate to a supported alternative.
• Remove the server from direct internet exposure and restrict access to trusted networks or a VPN.
• Place the service behind a reverse proxy or WAF with rules blocking oversized or malformed login requests to forum.ghp.
• Run the service with least privilege and isolate it in a segmented host or container to limit post-exploitation impact.
• Monitor vendor advisories for a fix, since the record does not confirm an available patch.

Detection

• Inspect web server and proxy logs for unusually long or malformed POST/GET requests to forum.ghp.
• Alert on crashes or restarts of the EFS Web Server process, which can indicate a failed overflow attempt.
• Use network IDS signatures for known EFS Web Server 7.2 overflow exploit traffic.
• Hunt for post-exploitation behavior such as unexpected child processes spawned by the web server.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.