Cerberus FTP Server vulnerabilities

In Cerberus FTP Server version 8.0.10.1, a crafted HTTP request causes the Windows service to crash. The attack involves a long Host header and an invalid Content-Length header.

Buffer overflow in Cerberus FTP Server 8.0.10.3 allows remote attackers to cause a denial of service (daemon crash) or possibly have unspecified other impact via a long MLST command.

A vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform UNC path injection via a manipulated parameter. By supplying a malicious SMB share path, an attacker can coerce authentication against the underlying server, resulting in leakage of the Cerberus service account's Net-NTLMv2 hash.

An insecure preserved inherited permissions vulnerability in Cerberus FTP Server on Windows allows Privilege Escalation. This issue has been resolved in Cerberus FTP Server: 2026.1.