EUVD-2025-16803Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This vulnerability presents HIGH real-world risk despite the CVSS 3.1 score of 7.3 (High severity) being somewhat conservative. Risk signals align strongly: (1) Attack Vector is Network with zero Authentication required and Low Complexity—trivial to exploit from anywhere; (2) Public POC availability significantly increases likelihood of mass exploitation; (3) CVSS impact ratings of Low (L:L, I:L, A:L) understate actual risk since buffer overflows in network daemons typically enable remote code execution; (4) The FreeFloat FTP Server is legacy software with limited modern deployments, reducing absolute exposure but increasing risk for organizations still relying on it; (5) No KEV (Known Exploited Vulnerability) status provided, but public disclosure and POC availability should be treated as equivalent exploitation probability signals. SSVC assessment: Exploitation is Proof-of-Concept/Active, the attack is highly Automatable, and Technical Impact ranges from Integrity (buffer corruption) to Confidentiality and Availability. This merits immediate priority patching. |
| Exploit ScenarioDerived | An unauthenticated remote attacker connects to the FreeFloat FTP Server on port 21 (default) and issues a SYSTEM command with a specially crafted payload containing more data than the fixed buffer can hold (e.g., a path or argument exceeding 256 or 512 bytes depending on the implementation). The buffer overflow overwrites adjacent stack memory, potentially including return addresses or function pointers. Depending on payload construction and memory layout, the attacker may: (1) Crash the FTP daemon (Denial of Service), (2) Read sensitive data from memory (information disclosure—credentials, system info), or (3) Execute arbitrary code with the privileges of the FTP server process (typically SYSTEM or Administrator on Windows, root on Linux). The attack requires no authentication, no user interaction, and can be fully automated using publicly available POC code, making this highly likely to be weaponized in automated attack campaigns targeting legacy systems. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 14, 2026
Critical buffer overflow vulnerability in FreeFloat FTP Server 1.0's SYSTEM Command Handler that allows unauthenticated remote attackers to achieve information disclosure, integrity violation, and service disruption. The vulnerability has been publicly disclosed with exploit code available, making it actively exploitable in real-world environments without requiring user interaction or elevated privileges.
RemediationAI
Immediate remediation steps: (1) Upgrade FreeFloat FTP Server to a patched version (vendor patch release information not provided in available data—contact FreeFloat/Unimative for patch availability); (2) If patching is not immediately possible, implement network-level mitigations: restrict FTP access via firewall ACLs to authorized IP ranges only, disable the SYSTEM command handler if possible through configuration, or disable the FTP service entirely if not critical; (3) Monitor FTP server logs for unusual SYSTEM command patterns or oversized input payloads; (4) Consider replacing FreeFloat FTP Server with modern maintained alternatives (vsftpd, ProFTPD, Pure-FTPd) that receive security updates; (5) Segment the FTP server on an isolated network with limited lateral movement capabilities.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the SYSTEM Command Handler component of FreeFloat FTP Server 1.0 (CPE: cpe:2.3:a:freefloat:ftp_server:1.0:*:*:*:*:*:*:*). The root cause is CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), a classic buffer overflow condition where user-supplied input to FTP protocol commands is not properly validated before being written to a fixed-size buffer. FTP servers implement command handlers that parse and execute client directives; the SYSTEM command handler specifically appears to lack input length validation, allowing an attacker to overflow the buffer with crafted FTP commands and execute arbitrary code or corrupt memory structures.
Know when Freefloat Ftp Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was found in FreeFloat FTP Server 1.0. It has been classified as critical. This affects an unknown part of the component SYSTEM Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Executive ViewAI
FreeFloat FTP Server 1.0 contains a critical buffer overflow vulnerability in its SYSTEM Command Handler that allows remote attackers to compromise affected systems. With a public exploit now available and no vendor patch released, any organization running this legacy FTP server is at immediate risk of unauthorized access, data theft, and system compromise.
Network-level mitigations: Restrict FTP access via firewall rules to trusted IP addresses only; place FTP server behind a WAF configured to detect buffer overflow patterns in FTP commands. Application-level mitigations: Disable or restrict access to the SYSTEM command handler if configuration options exist; disable the FTP service entirely if not essential to operations; implement rate limiting on connection attempts. Monitoring: Deploy IDS/IPS signatures to detect exploitation attempts; enable detailed FTP logging and review for suspicious SYSTEM command usage.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Freefloat Ftp Server
View allA stack-based buffer overflow vulnerability exists in FreeFloat FTP Server version 1.0.0. Rated medium severity (CVSS 6.
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Stack-based buffer overflow in FreeFloat FTP Server 1.0 allows remote authenticated users to execute arbitrary code via
Critical buffer overflow vulnerability in the NOOP Command Handler of FreeFloat FTP Server 1.0 that allows remote, unaut
A vulnerability was found in FreeFloat FTP Server 1.0 and classified as problematic. Rated high severity (CVSS 7.5), thi
Critical buffer overflow vulnerability in FreeFloat FTP Server 1.0's REIN Command Handler that allows unauthenticated re
Critical buffer overflow vulnerability in the XMKD Command Handler of FreeFloat FTP Server 1.0 that allows unauthenticat
Critical buffer overflow vulnerability in the XCWD Command Handler of FreeFloat FTP Server 1.0 that allows unauthenticat
Critical buffer overflow vulnerability in the RESTART Command Handler of FreeFloat FTP Server 1.0 that allows unauthenti
Critical buffer overflow vulnerability in FreeFloat FTP Server 1.0 affecting the REGET command handler, allowing unauthe
Critical buffer overflow vulnerability in the PROGRESS Command Handler of FreeFloat FTP Server 1.0 that allows unauthent
Critical buffer overflow vulnerability in the SET Command Handler of FreeFloat FTP Server 1.0 that allows unauthenticate
GitHub PoC
Exploit-DB