CVE-2022-22899

Vulnerability

Core FTP / SFTP Server v2 Build 725 contains a vulnerability in its SSH service that allows an unauthenticated attacker to cause a denial of service (DoS) by sending a specially crafted packet. The issue affects version 2 Build 725 and likely earlier builds; later builds (e.g., 778) include crash fixes that address this problem [1].

Exploitation

An attacker with network access to the SSH service (typically port 22) can exploit this vulnerability without any authentication or user interaction. The attacker simply sends a crafted packet to the server, triggering a crash or hang.

Impact

Successful exploitation results in a denial of service, rendering the Core FTP/SFTP Server unresponsive and disrupting file transfer operations for legitimate users.

Mitigation

Upgrade to Core FTP/SFTP Server v2 Build 778 or later, which includes crash updates and fixes [1]. No workarounds are documented. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.