What is the CVSS score of CVE-2025-5594?

CVE-2025-5594 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Freefloat Ftp Server are affected by CVE-2025-5594?

CVE-2025-5594 is a publicly disclosed remote buffer overflow vulnerability affecting FreeFloat FTP Server 1.0 with no available patch.

Is there a public PoC exploit available for CVE-2025-5594?

Yes, a public proof-of-concept exploit is available for CVE-2025-5594. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2025-5594?

Within 24 hours: Identify all systems running FreeFloat FTP Server 1.0 and isolate them from untrusted networks or take them offline if non-critical. Document inventory and assign ownership. Within 7 days: Evaluate migration to alternative FTP solutions (e.g., vsftpd, ProFTPD) or disable the FTP service entirely if business requirements allow. If continued use is unavoidable, implement strict network controls (see compensating controls). Within 30 days: Complete migration off FreeFloat FTP Server 1.0 or apply vendor patch if released; conduct security assessment of migrated systems.

Freefloat Ftp Server CVE-2025-5594

EUVD-2025-16895 HIGH

Buffer Overflow (CWE-119)

2025-06-04 cna@vuldb.com

Buffer Overflow Freefloat Ftp Server

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 17:29 euvd

EUVD-2025-16895

Analysis Generated

Mar 14, 2026 - 17:29 vuln.today

PoC Detected

Jun 13, 2025 - 00:58 vuln.today

Public exploit code

CVE Published

Jun 04, 2025 - 16:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability has been found in FreeFloat FTP Server 1.0 and classified as critical. This vulnerability affects unknown code of the component SET Command Handler. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Critical buffer overflow vulnerability in the SET Command Handler of FreeFloat FTP Server 1.0 that allows unauthenticated remote attackers to trigger memory corruption with potential for code execution or service disruption. The vulnerability has been publicly disclosed with exploit code available, increasing immediate risk of active exploitation in the wild. With a CVSS score of 7.3 and network-accessible attack vector requiring no privileges or user interaction, this represents a significant threat to any FTP infrastructure running the affected version.

Technical ContextAI

FreeFloat FTP Server 1.0 contains an input validation flaw in its SET command handler component, which fails to properly bounds-check user-supplied data before writing to a fixed-size buffer. This is a classic stack-based or heap-based buffer overflow (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer), a memory safety violation that allows attackers to overwrite adjacent memory regions. The FTP protocol's command-based architecture means the SET command is directly accessible over the network without prior authentication, making this trivially reachable. The vulnerability likely resides in the command parsing logic where the handler processes arguments without adequate length validation before copying them into an internal buffer.