External risk intelligence

Nico-FTP Structured Exception Handler Buffer Overflow

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2018-25254

NICO-FTP is a file transfer service. FTP services are commonly deployed as network-accessible servers intended to facilitate data transfer, making the application's primary function inherently internet or network-facing by design.

Out-of-bounds Write

Nico Ftp Project Nico Ftp

3.0.1.19 and earlier

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in NICO-FTP, a file transfer service. The flaw could allow unauthorized remote access and code execution, potentially leading to broader system compromise. The primary concern is to confirm if this specific software is in use and exposed to the internet.

Remote attackers can execute code via crafted FTP commands.
Understand its direct impact on your organization's exposure.
Confirm NICO-FTP usage and its network accessibility.

Attack Path

How an attacker could exploit the issue

An attacker can remotely target this vulnerability by connecting to the FTP service. By sending specially crafted FTP commands with oversized data, an attacker can overwrite exception handler pointers, redirecting program execution to their own malicious code.

Network access to FTP service required.
Crafted FTP commands trigger overflow.
Enables arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow remote attackers to execute arbitrary code by sending specially crafted FTP commands to the NICO-FTP service. When supported, this could affect the integrity and availability of the FTP service.

System data and service integrity at risk.
Exploited via crafted FTP commands.
Arbitrary code execution could occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

The NICO-FTP server, identified as a network-facing service, likely falls under the responsibility of the application owner or platform team. The first practical step is to determine the deployment scope of NICO-FTP, confirm its exposure and business criticality, and then assign an accountable owner to plan remediation.

Confirm NICO-FTP deployment and reachability.
Assign ownership to application or platform team.
Plan risk-based remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is NICO-FTP?

NICO-FTP is a software application designed to function as an FTP (File Transfer Protocol) server. Users deploy it to facilitate the transfer of files between computers over a network. It acts as the host service that listens for incoming connection requests to upload or download data.

How does CVE-2018-25254 work?

This vulnerability is a buffer overflow affecting the structured exception handler (SEH). It falls under CWE-787, which occurs when a program writes data beyond the boundaries of an intended memory buffer. In this case, sending oversized data through specific FTP commands overwrites system pointers, allowing an attacker to divert the software's execution flow toward unauthorized code.

What must an attacker do to trigger this flaw?

An attacker needs network connectivity to reach the running NICO-FTP service. They trigger the condition by sending specially crafted FTP commands that contain excessive amounts of data. Normal, compliant FTP commands that do not exceed expected buffer sizes will not trigger this specific memory corruption issue.

Is my system at risk?

According to Halo Surface Signal, NICO-FTP is a file transfer service inherently designed to be network-accessible, which frequently places it in an internet-facing role. If your instance of NICO-FTP is reachable from untrusted networks, your risk level is significantly higher because remote actors can reach the service without requiring internal network access.

What are the first steps to address this?

Begin by identifying if NICO-FTP is deployed within your environment and mapping its network reachability. Once you confirm its presence, assign an accountable owner to the application. Your goal is to evaluate its business necessity and plan appropriate remediation, such as restricting access or moving to a different solution, to mitigate the risk of arbitrary code execution.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.