CVE-2025-34108: CWE-121 Stack-based Buffer Overflow in Falconstor Software Disk Pulse Enterprise
A stack-based buffer overflow vulnerability exists in the login functionality of Disk Pulse Enterprise version 9.0.34. An attacker can send a specially crafted HTTP POST request to the /login endpoint with an overly long username parameter, causing a buffer overflow in the libspp.dll component. Successful exploitation allows arbitrary code execution with SYSTEM privileges.
AI Analysis
Technical Summary
This vulnerability is a stack-based buffer overflow (CWE-121) in the login feature of Disk Pulse Enterprise 9.0.34. An attacker can exploit this by sending a crafted HTTP POST request to the /login endpoint with an excessively long username parameter, causing a buffer overflow in the libspp.dll library. This can lead to arbitrary code execution with SYSTEM-level privileges. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.
Potential Impact
Successful exploitation results in arbitrary code execution with SYSTEM privileges, allowing an attacker to fully compromise the affected system. This can lead to complete loss of confidentiality, integrity, and availability of the system running Disk Pulse Enterprise 9.0.34.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. There is no official patch or fix information provided at this time. Until a patch is available, restrict access to the /login endpoint and monitor for suspicious HTTP POST requests with abnormally long username parameters.
CVE-2025-34108: CWE-121 Stack-based Buffer Overflow in Falconstor Software Disk Pulse Enterprise
Description
A stack-based buffer overflow vulnerability exists in the login functionality of Disk Pulse Enterprise version 9.0.34. An attacker can send a specially crafted HTTP POST request to the /login endpoint with an overly long username parameter, causing a buffer overflow in the libspp.dll component. Successful exploitation allows arbitrary code execution with SYSTEM privileges.
CVSS v4.0
Score 8.6high
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability is a stack-based buffer overflow (CWE-121) in the login feature of Disk Pulse Enterprise 9.0.34. An attacker can exploit this by sending a crafted HTTP POST request to the /login endpoint with an excessively long username parameter, causing a buffer overflow in the libspp.dll library. This can lead to arbitrary code execution with SYSTEM-level privileges. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.
Potential Impact
Successful exploitation results in arbitrary code execution with SYSTEM privileges, allowing an attacker to fully compromise the affected system. This can lead to complete loss of confidentiality, integrity, and availability of the system running Disk Pulse Enterprise 9.0.34.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. There is no official patch or fix information provided at this time. Until a patch is available, restrict access to the /login endpoint and monitor for suspicious HTTP POST requests with abnormally long username parameters.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2025-04-15T19:15:22.560Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 687654a5a83201eaaccea512
Added to database: 07/15/2025, 13:16:21 UTC
Last enriched: 07/15/2026, 09:51:08 UTC
Last updated: 09/10/2026, 19:36:50 UTC
Views: 229
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.