{"id":"CVE-2025-34108","revision":"0cc9bf53d2c943519e2c7652cc3f5b8a","records":[{"revision":"0cc9bf53d2c943519e2c7652cc3f5b8a","observedAt":"2026-10-29T21:48:56.968+00:00","statement":{"source":"cve-program","id":"CVE-2025-34108","aliases":[],"title":"Disk Pulse Enterprise 9.0.34 Login Stack Buffer Overflow","description":"A stack-based buffer overflow vulnerability exists in the login functionality of Disk Pulse Enterprise version 9.0.34. An attacker can send a specially crafted HTTP POST request to the /login endpoint with an overly long username parameter, causing a buffer overflow in the libspp.dll component. Successful exploitation allows arbitrary code execution with SYSTEM privileges.","state":0,"publishedAt":"2025-07-15T13:01:40.516+00:00","modifiedAt":"2026-10-29T20:19:00.8+00:00","affected":[{"ecosystem":"Vendor product","name":"Disk Pulse Enterprise","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unknown\",\n                    \"modules\": [\n                        \"libspp.dll\"\n                    ],\n                    \"platforms\": [\n                        \"Windows\"\n                    ],\n                    \"product\": \"Disk Pulse Enterprise\",\n                    \"vendor\": \"Flexense\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"9.0.34\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":8.6,"severity":"HIGH"}],"references":["https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/disk_pulse_enterprise_bof.rb","https://www.exploit-db.com/exploits/40452","https://vulners.com/metasploit/MSF:EXPLOIT-WINDOWS-HTTP-DISK_PULSE_ENTERPRISE_BOF-","https://advisories.checkpoint.com/defense/advisories/public/2017/cpai-2017-0006.html/","https://www.vulncheck.com/advisories/disk-pulse-enterprise-login-stack-buffer-overflow"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-34108","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-34108","identifiers":["CVE-2025-34108"]},"retained":false,"historicalAffected":[]}],"coverage":[]}