The vulnerability is a stack‑based buffer overflow in the log file name field of Axessh 4.2. By supplying a filename longer than the allocated buffer, an attacker can overwrite the return pointer at an offset of 214 bytes. This allows execution of attacker‑controlled shellcode with system privileges, giving full control of the host the application runs on. The weakness is identified as CWE‑787 and rated high severity.

Affected product is Axessh 4.2 from the vendor Labf. No further sub‑versions are listed, so all releases identified as 4.2 are susceptible unless a patch has been applied.

With a CVSS score of 8.6, this flaw is considered significant. The exploit requires local access; EPSS data is not available, and the vulnerability is not currently included in the CISA KEV catalog, suggesting no known widespread exploitation. Nevertheless, local attackers with the ability to create log file names can immediately trigger the buffer overflow, making the risk high for unattended systems.