Freefloat Ftp Server CVE-2025-5595

While the CVSS 3.1 score of 7.3 is elevated, the real-world risk is significantly contextualized by multiple factors: (1) CVSS Vector AV:N/AC:L/PR:N/UI:N indicates network-accessible, unauthenticated exploitation with no special user interaction required—this is worst-case for exposure; (2) The CWE-119 buffer overflow combined with public POC disclosure substantially increases exploitation probability and likelihood of active deployment in exploit kits; (3) However, FreeFloat FTP Server 1.0 is legacy software with minimal modern deployment—primarily found in legacy systems, embedded devices, or legacy infrastructure; (4) The partial impact classification (L for C/I/A) rather than High suggests memory corruption may not achieve arbitrary code execution reliably, limiting impact to denial-of-service or information disclosure in many cases. For security teams: This is a HIGH priority for legacy/embedded systems running FreeFloat FTP, but LOW priority for modern infrastructure. The disclosed POC elevates practical risk despite the 7.3 CVSS not reaching Critical threshold.

An attacker discovers a legacy system running FreeFloat FTP Server 1.0 via port scanning (TCP 21 open, FTP banner grab reveals version). The attacker crafts a specially constructed PROGRESS command with a payload exceeding the buffer boundary of the command handler. Given AV:N/AC:L, this is sent directly over the network via an FTP client or raw socket. The buffer overflow overwrites adjacent memory. If heap-based, the attacker may corrupt function pointers or heap metadata to achieve code execution or denial-of-service. If stack-based, the overflow corrupts the return address to redirect execution. With public POC availability, an attacker could automate this via an Metasploit module or custom exploit script. Realistic impact: either crash the FTP service (DoS) or, in optimized scenarios with controlled payload, achieve remote code execution as the FTP daemon user (often root on legacy systems). The attack requires zero authentication and zero user interaction.