Vulnerability record · CVE-2019-9760 · published 14 March 2019
CVE-2019-9760: FTPGetter Standard memory corruption via crafted FTP server responses
Ftpgetter · Ftpgetter
FTPGetter Standard v.5.97.0.177 has an out-of-bounds write (CWE-787) triggered by crafted responses from an attacker-controlled FTP server. Long responses can also crash the client through memory corruption. The flaw matters because it can lead to remote code execution on the machine running the FTP client.
Description
FTPGetter Standard v.5.97.0.177 allows remote code execution when a user initiates an FTP connection to an attacker-controlled machine that sends crafted responses. Long responses can also crash the FTP client with memory corruption.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityCritical CVSS (9.8) and high EPSS with public exploit code, but exploitation requires the user to connect to an attacker-controlled FTP server, which limits exposure.
What it is
FTPGetter Standard v.5.97.0.177 has an out-of-bounds write (CWE-787) triggered by crafted responses from an attacker-controlled FTP server. Long responses can also crash the client through memory corruption. The flaw matters because it can lead to remote code execution on the machine running the FTP client.
Impact
An attacker who controls the FTP server can execute arbitrary code on the connecting client host, and can at minimum crash the client via memory corruption.
Attack surface
Reached over the network when a user initiates an FTP connection to an attacker-controlled server; the CVSS vector indicates no privileges and no user interaction beyond the connection itself, though the description states a user must initiate the FTP connection.
Exploitation
Public exploit code exists (Exploit-DB 46543 and a GitHub PoC), and EPSS is 0.53093 (98.9th percentile), indicating high predicted exploitation activity; the CVE is not listed in CISA KEV.
What to do
- Upgrade FTPGetter Standard to a version later than 5.97.0.177 if the vendor has released a fix; no fixed version is stated in this record, so confirm with the vendor.
- If no patch is available, stop using FTPGetter Standard for connections to untrusted or third-party FTP servers.
- Restrict outbound FTP traffic to known, trusted servers via firewall or egress filtering.
- Isolate FTP client hosts so a compromised client cannot reach sensitive internal systems.
Detection
- Monitor FTPGetter process crashes or abnormal terminations and correlate with outbound FTP connections.
- Alert on FTPGetter making connections to newly seen or untrusted FTP server IPs.
- Look for unexpected child processes or code execution spawned by the FTPGetter process.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://github.com/w4fz5uck5/FTPGetter/blob/master/xpl.py | ExploitThird Party Advisory |
| https://www.exploit-db.com/exploits/46543/ | ExploitThird Party AdvisoryVDB Entry |
| https://github.com/w4fz5uck5/FTPGetter/blob/master/xpl.py | ExploitThird Party Advisory |
| https://www.exploit-db.com/exploits/46543/ | ExploitThird Party AdvisoryVDB Entry |
Track CVE-2019-9760 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2019-9760), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
