CVE-2022-50689
Buffer Overflow in Cobian Reflector 0.9.93 RC1 Causes DoS
Publication date: 2025-12-22
Last updated on: 2025-12-22
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| cobian | cobian_reflector | 0.9.93_rc1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-120 | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2022-50689 is a local denial of service vulnerability in Cobian Reflector version 0.9.93 RC1. It occurs because the application improperly handles the password input field during SFTP task configuration. An attacker can paste a large buffer of about 8000 bytes into the password field, causing a buffer overflow that crashes the application. This does not allow remote code execution or privilege escalation but results in the application becoming unavailable. [1, 2]
How can this vulnerability impact me? :
This vulnerability can cause the Cobian Reflector application to crash when an attacker inputs an excessively long password string during SFTP task configuration. The impact is a denial of service, making the application unavailable to legitimate users. It does not allow attackers to execute code or escalate privileges but disrupts normal operation locally. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to reproduce the denial of service condition locally on the system running Cobian Reflector 0.9.93 RC1. Specifically, you can create a large buffer (approximately 8000 bytes) of a single character (e.g., 'A'), copy it to the clipboard, and then paste it into the password field during SFTP task configuration in the Cobian Reflector UI. If the application crashes upon testing the settings, the vulnerability is present. A Python script can be used to generate the large buffer file, which can then be copied to the clipboard. The steps include creating a new task, adding an SFTP source, setting connection parameters, and pasting the large buffer into the password field. No specific network commands are applicable since the attack vector is local. [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include avoiding pasting or entering excessively long passwords (around 8000 bytes) into the password field during SFTP task configuration in Cobian Reflector 0.9.93 RC1. Since the vulnerability is local and triggered by buffer overflow in the password input, restricting user input length or validating input size before processing can prevent the crash. Additionally, consider updating to a fixed or newer version of Cobian Reflector if available, or applying any patches provided by the vendor. Until a fix is available, limit access to the application to trusted users to prevent exploitation. [1, 2]