← Vulnerability feed

Vulnerability record · CVE-2019-16116 · published 2 October 2019

CVE-2019-16116: Enterprisedt completeftp server broken cryptographic algorithm vulnerability

Enterprisedt · Completeftp Server

EnterpriseDT CompleteFTP Server prior to version 12.1.3 is vulnerable to information exposure in the Bootstrap.log file. This allows an attacker to obtain the administrator password hash.

4.3 CVSS 3.1 Medium EPSS 3.7% · top 10.7% CWE-327 · Broken cryptographic algorithmCWE-532 · Sensitive information in log file
4.3CVSS 3.1 base score, v2 3.5
3.7%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

EnterpriseDT CompleteFTP Server prior to version 12.1.3 is vulnerable to information exposure in the Bootstrap.log file. This allows an attacker to obtain the administrator password hash.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://enterprisedt.com/products/completeftp/doc/guide/html/history.html Release NotesVendor Advisory
https://rhinosecuritylabs.com/application-security/completeftp-server-local-privesc-cve-2019-16116/ ExploitThird Party Advisory
https://enterprisedt.com/products/completeftp/doc/guide/html/history.html Release NotesVendor Advisory
https://rhinosecuritylabs.com/application-security/completeftp-server-local-privesc-cve-2019-16116/ ExploitThird Party Advisory

Track CVE-2019-16116 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.1CVE-2022-2560CompleteFTP Server unauthenticated path traversal allows arbitrary file deletionEnterpriseDT CompleteFTP 22.1.0 Server fails to validate a user-supplied path in the HttpFile class before using it in file operations, allowing path…EPSS 78%analysed8.8CVE-2019-16864Enterprisedt completeftp server command injection vulnerabilityCompleteFTPService.exe in the server in EnterpriseDT CompleteFTP before 12.1.4 allows Remote Code Execution by leveraging a Windows user account that…EPSS 7.7%

Source: NIST National Vulnerability Database (record CVE-2019-16116), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.