CVE-2014-2735 in WinSCP
Summary
by MITRE
WinSCP before 5.5.3, when FTP with TLS is used, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified in WinSCP versions prior to 5.5.3 represents a critical failure in transport layer security validation when utilizing FTP over TLS connections. This flaw stems from the application's inability to properly verify that the hostname of the remote server matches one of the domain names listed within the subject Common Name or Subject Alternative Name fields of the presented X.509 certificate. In standard secure communication protocols, such as HTTPS and SFTP with key verification, clients are expected to perform strict host name matching against the certificates provided by servers to ensure they are communicating with the intended entity rather than an imposter. By omitting this crucial validation step for FTP over TLS sessions, WinSCP effectively disables a primary defense mechanism designed to prevent identity spoofing attacks.
From a technical perspective, this deficiency allows man-in-the-middle attackers to intercept and manipulate network traffic between the client and the server without triggering security warnings or connection failures. An attacker positioned within the communication path can present an arbitrary but validly signed certificate that does not correspond to the actual hostname of the target FTP server. Since WinSCP accepts any certificate as long as it is cryptographically valid, regardless of whether its identity matches the requested host, the encryption channel remains established under false pretenses. This means that while data may appear encrypted in transit, the confidentiality and integrity guarantees are compromised because the client cannot distinguish between a legitimate server and an malicious proxy intercepting the connection.
The operational impact of this vulnerability is severe, particularly for users who rely on FTP over TLS to protect sensitive credentials and file transfers from eavesdropping. If an attacker successfully exploits this flaw, they can decrypt traffic intended for secure transmission, potentially harvesting usernames, passwords, and proprietary data stored in transferred files. This scenario aligns with the Common Weakness Enumeration identifier CWE-295, which describes Improper Certificate Validation, specifically highlighting failures to validate certificate hostnames or trust anchors. Furthermore, within the context of cyber attack frameworks such as MITRE ATT&CK, this vulnerability facilitates techniques associated with Man-in-the-Middle attacks and Credential Access, enabling adversaries to perform passive reconnaissance or active data exfiltration by masquerading as a trusted service endpoint.
To mitigate this risk, organizations must ensure that all instances of WinSCP are upgraded to version 5.5.3 or later, where the host name verification logic has been corrected to enforce strict matching against certificate fields. In environments where upgrading is not immediately feasible, administrators should consider implementing network-level controls such as firewall rules restricting direct FTP over TLS connections to known IP addresses and ports, thereby reducing the attack surface available for interception attempts. Additionally, users can be advised to utilize alternative protocols like SFTP or SCP which rely on different authentication mechanisms less susceptible to this specific certificate validation flaw, provided that proper host key verification is maintained within those tools as well.