CVE-2020-37107CWE-120

Core FTP LE 2.2 - Denial of Service

Medium · published February 6, 2026

CVSS v4.0
6.7
EPSS
0%
Percentile
35.3
In the wild
Unconfirmed
What it is

⚠️ A single oversized text entry can turn Core FTP LE 2.2 into a no-show! This denial of service vulnerability lets attackers crash the application by stuffing a whopping 20,000 characters into the account field. 😱 Think of it like a stubborn jam in a busy restaurant: one customer orders an astonishingly large meal, and suddenly, the kitchen is in chaos, unable to serve anyone else until they fix the mess. This flaw allows attackers to make Core FTP LE 2.2 unresponsive, leading to a frustrating experience as users must reinstall the application to get back on track. While it won’t compromise your data, it can certainly disrupt your workflow!

Put simply

Think of it like a stubborn jam in a busy restaurant: one customer orders an astonishingly large meal, and suddenly, the kitchen is in chaos, unable to serve anyone else until they fix the mess. The denial of service vulnerability occurs when a large buffer is written to the account field, causing the application to crash due to resource exhaustion.

What to do

This flaw allows attackers to make Core FTP LE 2.2 unresponsive, leading to a frustrating experience as users must reinstall the application to get back on track. While it won’t compromise your data, it can certainly disrupt your workflow! To safeguard against this vulnerability, ensure you're running an updated version of Core FTP LE. Moreover, consider implementing input validation on text fields to limit the size of entries. Regularly check for updates to keep your system secure! You’ve got this! With these steps, you can keep your FTP setup running smoothly! 🛡️

The record
Technical detail
CVSS v4.0
6.7 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00420 · 35.3th percentile
Weakness
CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published
2026-02-06T23:14Z
EPSS history
Timeline
  • 06 FEB 23:14Z
    Core FTP LE 2.2 - Denial of Service
    cvelistv5