CVE-2018-25296
Buffer Overflow in P10 CMS Login Causes Application Crash
Publication date: 2026-04-26
Last updated on: 2026-04-26
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-120 | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in P10 Central Management Software version 1.4.13 and is a buffer overflow issue in the login password field.
Local attackers can exploit this by submitting an oversized input string—specifically, a 2000-byte payload—into the password field.
Doing so causes the application to crash, resulting in a denial of service.
How can this vulnerability impact me? :
The primary impact of this vulnerability is that an attacker with local access can cause the P10 Central Management Software to crash by submitting an oversized password input.
This leads to a denial of service condition, potentially disrupting normal operations and availability of the software.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to reproduce the application crash caused by submitting an oversized input string in the login password field.
Specifically, an attacker or tester can paste a payload of approximately 2000 bytes into the password field and attempt to log in. If the application crashes or becomes unresponsive, it indicates the presence of the vulnerability.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting local access to the P10 Central Management Software to trusted users only, as the vulnerability requires local attacker interaction.
Additionally, avoid submitting unusually large inputs in the password field to prevent triggering the buffer overflow and application crash.
Monitoring the application for crashes and applying any available patches or updates from the vendor as soon as they are released is also recommended.