EUVD-2025-16965Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | While the CVSS 3.1 score of 7.3 indicates high severity, detailed analysis reveals moderate real-world risk. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) shows this is remotely exploitable with low attack complexity and no privileges required, which is concerning. However, the limited impact scores (C:L, I:L, A:L) suggest the vulnerability does not provide complete system compromise—it's limited to partial confidentiality/integrity loss and service disruption rather than full takeover. The public disclosure and available exploit code elevate risk significantly; attackers with basic FTP knowledge can weaponize this. EPSS exploitation probability would likely be high given the public POC and trivial attack prerequisites. The vulnerability should be prioritized for patching on internet-facing or trusted-network FTP servers, particularly in legacy infrastructure where PCMan FTP Server is still deployed, but does not represent a critical RCE risk in most scenarios unless the server runs with elevated privileges. |
| Exploit ScenarioDerived | An attacker identifies an internet-facing PCMan FTP Server 2.0.7 instance using port scanning or FTP banner grabbing. Without authentication, the attacker connects to the FTP server on port 21 and sends a crafted SYSTEM command with an oversized parameter payload designed to overflow the command handler's buffer. The buffer overflow corrupts the stack, potentially allowing the attacker to overwrite a function return pointer or trigger a denial of service by crashing the FTP daemon. If the attacker crafts the payload carefully with shellcode, they may achieve limited code execution with the privileges of the FTP server process. The attack requires no special privileges, no user interaction, and succeeds reliably given the low attack complexity. With the public POC available, script kiddies and automated scanning tools can weaponize this vulnerability against unpatched systems at scale. The impact ranges from service disruption (DoS via crash) to potential remote code execution depending on exploit sophistication and server configuration. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 14, 2026
Critical buffer overflow vulnerability in PCMan FTP Server 2.0.7's SYSTEM Command Handler that allows unauthenticated remote attackers to cause denial of service and potentially execute arbitrary code with limited impact on confidentiality and integrity. The vulnerability has been publicly disclosed with exploit code available, making it actively exploitable in the wild against unpatched systems.
RemediationAI
Immediate remediation steps: (1) Update PCMan FTP Server to the latest patched version beyond 2.0.7 if available from the official vendor; (2) If no patch exists, disable or uninstall PCMan FTP Server and migrate to a modern, maintained FTP server solution (e.g., ProFTPD, vsftpd, or FileZilla Server); (3) If the service must remain operational, implement network-level access controls restricting FTP traffic (TCP port 21) to specific trusted IP addresses only; (4) Monitor FTP server logs for unusual SYSTEM command attempts or buffer overflow attack patterns; (5) Consider replacing FTP entirely with SFTP/SSH, which provides encryption and modern security practices. Workarounds are limited given the nature of buffer overflows, so patching or service replacement is essential.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PCMan FTP Server is a lightweight FTP daemon commonly used on Windows systems. The vulnerability exists in the SYSTEM Command Handler component, which processes FTP protocol commands. The root cause is CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), a classic buffer overflow condition where input from FTP commands is not properly validated before being written to a fixed-size buffer. This allows an attacker to overflow the buffer and potentially overwrite adjacent memory structures, including function pointers or return addresses on the stack. The FTP protocol itself is legacy and unencrypted, making packet inspection and command injection straightforward for attackers. The vulnerability likely resides in command parsing logic where user-supplied parameters in SYSTEM-related FTP commands are copied without bounds checking.
Know when Ftp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability, which was classified as critical, was found in PCMan FTP Server 2.0.7. Affected is an unknown function of the component SYSTEM Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Executive ViewAI
PCMan FTP Server 2.0.7 contains a critical buffer overflow vulnerability that allows remote attackers to execute arbitrary code without authentication. Organizations running this FTP server are at immediate risk of compromise, especially as public exploits are already available and no vendor patch exists. Immediate action is required to protect affected systems from active exploitation.
Disable PCMan FTP Server immediately if not critical to operations; if required, implement network segmentation restricting FTP access to specific trusted hosts/VLANs only, deploy IDS/IPS signatures to detect buffer overflow attempts on FTP ports, monitor for suspicious SYSTEM command activity, and apply strict firewall rules limiting connections to authorized users only via IP whitelisting.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Wing FTP Server before 7.4.4 contains a critical remote code execution vulnerability (CVE-2025-47812, CVSS 10.0) through
Critical buffer overflow vulnerability in the NOOP Command Handler of FreeFloat FTP Server 1.0 that allows remote, unaut
The FTP (aka "Implementation of a simple FTP client and server") project through 96c1a35 allows remote attackers to caus
Critical buffer overflow vulnerability in the SET Command Handler of PCMan FTP Server 2.0.7 that allows remote attackers
A buffer overflow vulnerability in A vulnerability classified as critical (CVSS 7.3). Risk factors: public PoC available
Critical buffer overflow vulnerability in the HOST Command Handler of FreeFloat FTP Server 1.0 that allows unauthenticat
Critical buffer overflow vulnerability in FreeFloat FTP Server 1.0's SYSTEM Command Handler that allows unauthenticated
Critical buffer overflow vulnerability in the PASV command handler of FreeFloat FTP Server 1.0 that allows unauthenticat
Information disclosure in the Eclipse ThreadX NetX Duo embedded TCP/IP stack's FTP server addon lets a network attacker
GitHub PoC
Exploit-DB