EUVD-2025-16803Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was found in FreeFloat FTP Server 1.0. It has been classified as critical. This affects an unknown part of the component SYSTEM Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
Critical buffer overflow vulnerability in FreeFloat FTP Server 1.0's SYSTEM Command Handler that allows unauthenticated remote attackers to achieve information disclosure, integrity violation, and service disruption. The vulnerability has been publicly disclosed with exploit code available, making it actively exploitable in real-world environments without requiring user interaction or elevated privileges.
Technical ContextAI
The vulnerability exists in the SYSTEM Command Handler component of FreeFloat FTP Server 1.0 (CPE: cpe:2.3:a:freefloat:ftp_server:1.0:*:*:*:*:*:*:*). The root cause is CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), a classic buffer overflow condition where user-supplied input to FTP protocol commands is not properly validated before being written to a fixed-size buffer. FTP servers implement command handlers that parse and execute client directives; the SYSTEM command handler specifically appears to lack input length validation, allowing an attacker to overflow the buffer with crafted FTP commands and execute arbitrary code or corrupt memory structures.
RemediationAI
Immediate remediation steps: (1) Upgrade FreeFloat FTP Server to a patched version (vendor patch release information not provided in available data—contact FreeFloat/Unimative for patch availability); (2) If patching is not immediately possible, implement network-level mitigations: restrict FTP access via firewall ACLs to authorized IP ranges only, disable the SYSTEM command handler if possible through configuration, or disable the FTP service entirely if not critical; (3) Monitor FTP server logs for unusual SYSTEM command patterns or oversized input payloads; (4) Consider replacing FreeFloat FTP Server with modern maintained alternatives (vsftpd, ProFTPD, Pure-FTPd) that receive security updates; (5) Segment the FTP server on an isolated network with limited lateral movement capabilities.
Wing FTP Server before 7.4.4 contains a critical remote code execution vulnerability (CVE-2025-47812, CVSS 10.0) through
Critical buffer overflow vulnerability in the NOOP Command Handler of FreeFloat FTP Server 1.0 that allows remote, unaut
The FTP (aka "Implementation of a simple FTP client and server") project through 96c1a35 allows remote attackers to caus
Critical buffer overflow vulnerability in PCMan FTP Server 2.0.7's SYSTEM Command Handler that allows unauthenticated re
Critical buffer overflow vulnerability in the SET Command Handler of PCMan FTP Server 2.0.7 that allows remote attackers
Critical buffer overflow vulnerability in PCMan FTP Server 2.0.7 affecting the PLS Command Handler component. Remote att
A buffer overflow vulnerability in A vulnerability classified as critical (CVSS 7.3). Risk factors: public PoC available
Critical buffer overflow vulnerability in the HOST Command Handler of FreeFloat FTP Server 1.0 that allows unauthenticat
Critical buffer overflow vulnerability in the PASV command handler of FreeFloat FTP Server 1.0 that allows unauthenticat
Linux kernel netfilter FTP NAT helper fails to properly initialize sequence adjustment extensions when connection tracki
Same weakness CWE-119 – Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today