CVE-2025-34108

HIGH

Disk Pulse Enterprise <9.0.34 - Buffer Overflow

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2025-34108. PoCs published by Tulpa, Chris Higgins, Tulpa Security, including Metasploit module exploits/windows/http/disk_pulse_enterprise_bof.

AI-analyzed exploit summary This exploit targets a buffer overflow vulnerability in Disk Pulse Enterprise 9.0.34, leveraging a crafted HTTP POST request to achieve remote code execution. It uses a SEH-based exploit with an egghunter and Meterpreter shellcode to gain SYSTEM-level access on Windows 7 x86.

Description

A stack-based buffer overflow vulnerability exists in the login functionality of Disk Pulse Enterprise version 9.0.34. An attacker can send a specially crafted HTTP POST request to the /login endpoint with an overly long username parameter, causing a buffer overflow in the libspp.dll component. Successful exploitation allows arbitrary code execution with SYSTEM privileges.

Exploits (2)

exploitdb WORKING POC VERIFIED
by Tulpa · pythonremotewindows
https://www.exploit-db.com/exploits/40452

This exploit targets a buffer overflow vulnerability in Disk Pulse Enterprise 9.0.34, leveraging a crafted HTTP POST request to achieve remote code execution. It uses a SEH-based exploit with an egghunter and Meterpreter shellcode to gain SYSTEM-level access on Windows 7 x86.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Disk Pulse Enterprise 9.0.34
No auth needed
Prerequisites: Network access to the target · Target running Disk Pulse Enterprise 9.0.34 on Windows 7 x86
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
by Chris Higgins, Tulpa Security · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/disk_pulse_enterprise_bof.rb

This Metasploit module exploits a stack buffer overflow in Disk Pulse Enterprise 9.0.34 via a malicious HTTP login request, achieving remote code execution under the NT AUTHORITY\SYSTEM account using an egghunter technique.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Disk Pulse Enterprise 9.0.34
No auth needed
Prerequisites: Network access to the target's HTTP service on port 80
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Scores

CVSS v4 8.6
EPSS 0.7048
EPSS Percentile 98.7%
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-121 CWE-20
Status published
Products (1)
Falconstor Software/Disk Pulse Enterprise 9.0.34
Published Jul 15, 2025
Tracked Since Feb 18, 2026