Freefloat Ftp Server CVE-2025-5594

This vulnerability presents HIGH real-world risk despite the 7.3 CVSS score (which may underestimate actual impact). Risk signals indicate: (1) CVSS Vector shows AV:N (network-accessible), AC:L (low complexity), PR:N (no privileges required), UI:N (no user interaction)—all maximum-severity factors for exploitability; (2) Public exploit disclosure significantly increases EPSS probability; (3) The vulnerability likely has automatable exploitation characteristics given the deterministic nature of buffer overflows in legacy FTP implementations; (4) Technical impact includes confidentiality, integrity, and availability compromise; (5) FreeFloat FTP Server 1.0 is a legacy product with potentially slow or unavailable patching cycles. The combination of public PoC, unauthenticated remote access, and memory corruption makes this a likely candidate for active exploitation by both script-based attackers and sophisticated threat actors. Organizations should treat this as critical regardless of CVSS score.

An unauthenticated attacker on the internet identifies a FreeFloat FTP Server 1.0 instance listening on port 21 (or a scanned non-standard port). The attacker crafts a malicious FTP SET command with an oversized argument payload designed to overflow the buffer in the command handler. Due to the low attack complexity and lack of authentication barriers, the attacker sends the payload over a simple TCP connection without authentication. The buffer overflow corrupts adjacent memory, potentially allowing the attacker to: (1) achieve remote code execution (RCE) by overwriting a function pointer or return address, (2) crash the FTP service causing denial of service, or (3) read sensitive data from memory if the overflow allows information disclosure. Public PoC code would automate this process, enabling widespread scanning and exploitation by low-skilled attackers and botnets.