---
id: CVE-2025-34108
title: Disk Pulse Enterprise 9.0.34 Login Stack Buffer Overflow
summary: >-
  A stack-based buffer overflow vulnerability exists in the login functionality
  of Disk Pulse Enterprise version 9.0.34. An attacker can send a specially
  crafted HTTP POST request to the /login endpoint with an overly long username
  paramet…
severity: high
cvss: 8.6
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-121
  - CWE-20
vendor: Flexense
product: Disk Pulse Enterprise
affected:
  - disk_pulse_enterprise 9.0.34
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2025-07-15T13:39:32.897813Z'
exploitAvailable: true
published: '2025-07-15'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T21:15:14.014Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-34108'
references:
  - url: >-
      https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/disk_pulse_enterprise_bof.rb
  - url: 'https://www.exploit-db.com/exploits/40452'
  - url: >-
      https://vulners.com/metasploit/MSF:EXPLOIT-WINDOWS-HTTP-DISK_PULSE_ENTERPRISE_BOF-
  - url: >-
      https://advisories.checkpoint.com/defense/advisories/public/2017/cpai-2017-0006.html/
  - url: >-
      https://www.vulncheck.com/advisories/disk-pulse-enterprise-login-stack-buffer-overflow
tags:
  - cve.org
  - exploit-available
epss: 0.01439
epssPercentile: 0.73165
exploits:
  metasploit:
    - exploit/windows/http/disk_pulse_enterprise_bof
  checkedAt: '2026-11-03T08:40:12.830Z'
ingestedAt: '2026-11-03T08:39:35.538Z'
---

## Overview

A stack-based buffer overflow vulnerability exists in the login functionality of Disk Pulse Enterprise version 9.0.34. An attacker can send a specially crafted HTTP POST request to the /login endpoint with an overly long username parameter, causing a buffer overflow in the libspp.dll component. Successful exploitation allows arbitrary code execution with SYSTEM privileges.

## Affected

- `disk_pulse_enterprise 9.0.34`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.