CVE-2019-25628

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2019-25628", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-03-24T11:00:53.962Z", "datePublished": "2026-03-24T11:27:03.194Z", "dateUpdated": "2026-03-24T13:52:16.320Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-03-24T11:27:03.194Z"}, "title": "Download Accelerator Plus DAP 10.0.6.0 SEH Buffer Overflow", "descriptions": [{"lang": "en", "value": "Download Accelerator Plus DAP 10.0.6.0 contains a structured exception handler buffer overflow vulnerability that allows remote attackers to execute arbitrary code by crafting malicious URLs. Attackers can create specially crafted URLs with overflowing buffer data that overwrites SEH pointers and executes embedded shellcode when imported through the application's web page import functionality."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Out-of-bounds Write", "cweId": "CWE-787", "type": "CWE"}]}], "affected": [{"vendor": "Speedbit", "product": "Download Accelerator Plus DAP", "versions": [{"version": "10.0.6.0 #", "status": "affected"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.3, "baseSeverity": "CRITICAL", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS"}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS"}], "references": [{"url": "https://www.exploit-db.com/exploits/46673", "name": "ExploitDB-46673", "tags": ["exploit"]}, {"url": "http://www.speedbit.com/dap/", "name": "Official Product Homepage", "tags": ["product"]}, {"url": "http://www.speedbit.com/dap/download/downloading.asp", "name": "Product Reference", "tags": ["product"]}, {"name": "VulnCheck Advisory: Download Accelerator Plus DAP 10.0.6.0 SEH Buffer Overflow", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/download-accelerator-plus-dap-seh-buffer-overflow"}], "credits": [{"lang": "en", "value": "Peyman Forouzan #", "type": "finder"}], "x_generator": {"engine": "vulncheck"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-24T13:51:15.947776Z", "id": "CVE-2019-25628", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T13:52:16.320Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2019-25628", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-24T13:51:15.947776Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T13:52:04.389Z"}}], "cna": {"title": "Download Accelerator Plus DAP 10.0.6.0 SEH Buffer Overflow", "credits": [{"lang": "en", "type": "finder", "value": "Peyman Forouzan #"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Speedbit", "product": "Download Accelerator Plus DAP", "versions": [{"status": "affected", "version": "10.0.6.0 #"}]}], "references": [{"url": "https://www.exploit-db.com/exploits/46673", "name": "ExploitDB-46673", "tags": ["exploit"]}, {"url": "http://www.speedbit.com/dap/", "name": "Official Product Homepage", "tags": ["product"]}, {"url": "http://www.speedbit.com/dap/download/downloading.asp", "name": "Product Reference", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/download-accelerator-plus-dap-seh-buffer-overflow", "name": "VulnCheck Advisory: Download Accelerator Plus DAP 10.0.6.0 SEH Buffer Overflow", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck"}, "descriptions": [{"lang": "en", "value": "Download Accelerator Plus DAP 10.0.6.0 contains a structured exception handler buffer overflow vulnerability that allows remote attackers to execute arbitrary code by crafting malicious URLs. Attackers can create specially crafted URLs with overflowing buffer data that overwrites SEH pointers and executes embedded shellcode when imported through the application's web page import functionality."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-03-24T11:27:03.194Z"}}}, "cveMetadata": {"cveId": "CVE-2019-25628", "state": "PUBLISHED", "dateUpdated": "2026-03-24T13:52:16.320Z", "dateReserved": "2026-03-24T11:00:53.962Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-03-24T11:27:03.194Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Download Accelerator Plus DAP", "vendor": "Speedbit", "versions": [{"status": "affected", "version": "10.0.6.0 #"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Download Accelerator Plus DAP 10.0.6.0 contains a structured exception handler buffer overflow vulnerability that allows remote attackers to execute arbitrary code by crafting malicious URLs. Attackers can create specially crafted URLs with overflowing buffer data that overwrites SEH pointers and executes embedded shellcode when imported through the application's web page import functionality."}, {"lang": "es", "value": "Download Accelerator Plus DAP 10.0.6.0 contiene una vulnerabilidad de desbordamiento de b\u00fafer en el gestor de excepciones estructuradas que permite a atacantes remotos ejecutar c\u00f3digo arbitrario mediante la creaci\u00f3n de URL maliciosas. Los atacantes pueden crear URL especialmente dise\u00f1adas con datos de b\u00fafer desbordados que sobrescriben los punteros SEH y ejecutan shellcode incrustado cuando se importa a trav\u00e9s de la funcionalidad de importaci\u00f3n de p\u00e1ginas web de la aplicaci\u00f3n."}], "id": "CVE-2019-25628", "lastModified": "2026-06-17T02:32:49.937", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2019-25628", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-24T13:51:15.947776Z", "version": "2.0.3"}}]}, "published": "2026-03-24T12:16:02.777", "references": [{"source": "disclosure@vulncheck.com", "url": "http://www.speedbit.com/dap/"}, {"source": "disclosure@vulncheck.com", "url": "http://www.speedbit.com/dap/download/downloading.asp"}, {"source": "disclosure@vulncheck.com", "url": "https://www.exploit-db.com/exploits/46673"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/download-accelerator-plus-dap-seh-buffer-overflow"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "10.0.6.0"}}], "enrichment": {"confidence": 94.0, "confidence_source": "matching", "scores": [{"score": 94.0, "source": "matching"}]}, "original": {"product": "Download Accelerator Plus DAP", "source": "cna", "vendor": "Speedbit"}, "product": "download_accelerator_plus", "vendor": "speedbit"}], "analysis": {"en": {"generated_at": "2026-03-24T12:52:54.035051+00:00", "value": {"mitigation_remediation": ["Apply the vendor patch or upgrade to a version that resolves the SEH overflow", "If no patch is available, disable or block the web page import functionality so malicious URLs cannot reach the vulnerable code", "Avoid following unknown or malformed URLs that could trigger the overflow", "Regularly monitor vendor advisories for updates"], "summary": {"action": "Immediate Patch", "impact": "Remote code execution"}, "threat_synthesis": {"affected_systems": "The affected product is Speedbit Download Accelerator Plus DAP, version 10.0.6.0. No other versions are listed as vulnerable in the available data. Users running earlier or later releases are not identified as affected.", "description_and_impact": "The flaw is a structured exception handler buffer overflow in Download Accelerator Plus DAP 10.0.6.0. By crafting a malicious URL that overflows the buffer, an attacker can overwrite SEH pointers and execute arbitrary shellcode when the URL is imported through the application's web page import feature. This vulnerability allows remote attackers to run code with the privileges of the user running the application, compromising confidentiality, integrity, and availability of the machine.", "risk_and_exploitability": "The severity is reflected in a CVSS score of 9.3, indicating a high\u2011impact remote code execution risk. The EPSS score is not provided, and the vulnerability is not in the CISA KEV catalog, but the condition of a buffer overflow with an exploitable SEH pointer is widely known to be easy to exploit. Attackers can trigger the flaw by sending a crafted URL to a user who imports it, and no authentication is required, so the attack can be performed remotely with minimal effort. The potential impact is full control over the affected system."}}}}, "created": "2026-03-25T11:48:46.938550+00:00", "updated": "2026-03-25T20:39:42.492040+00:00", "vendors": ["speedbit", "speedbit$PRODUCT$download_accelerator_plus"]}