LabF WinaXe FTP Client 7.7 WCMDPA10.dll stack-based overflow

Summaryinfo

A vulnerability marked as critical has been reported in LabF WinaXe FTP Client 7.7. This issue affects some unknown processing in the library WCMDPA10.dll. The manipulation leads to stack-based overflow. This vulnerability is uniquely identified as CVE-2025-34107. The attack is possible to be carried out remotely. Moreover, an exploit is present.

Detailsinfo

A vulnerability, which was classified as critical, has been found in LabF WinaXe FTP Client 7.7. This issue affects an unknown code in the library WCMDPA10.dll. The manipulation with an unknown input leads to a stack-based overflow vulnerability. Using CWE to declare the problem leads to CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A buffer overflow vulnerability exists in the WinaXe FTP Client version 7.7 within the FTP banner parsing functionality, WCMDPA10.dll. When the client connects to a remote FTP server and receives an overly long '220 Server Ready' response, the vulnerable component responsible for parsing the banner overflows a stack buffer, leading to arbitrary code execution under the context of the user.

The weakness was disclosed by hyp3rlinx. The advisory is shared at raw.githubusercontent.com. The identification of this vulnerability is CVE-2025-34107 since 04/15/2025. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details as well as a public exploit are known.

The exploit is available at exploit-db.com. It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Exploit-DB (40767) and EUVD (EUVD-2025-21424). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• LabF

Name

• WinaXe FTP Client

Version

• 7.7

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion