Freefloat Ftp Server CVE-2025-5664

RISK LEVEL: HIGH (operational priority). CVSS 7.3 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L indicates: (1) Network-accessible with no complexity, (2) no privileges required, (3) no user interaction needed—all maximum exploitability factors. However, the IMPACT metrics show only LOW confidentiality/integrity/availability impact, suggesting the overflow may not reliably achieve RCE but can crash the service or leak memory. EXPLOITATION STATUS: Public PoC disclosed increases real-world risk substantially; attackers have working exploit code. AUTOMATABLE: Yes—FTP protocol is binary and deterministic; exploit delivery is trivial via script. TECHNICAL IMPACT: Crash (confirmed DoS), potential information disclosure (buffer overflow can leak heap/stack memory), and the possibility of code execution depending on memory layout and exploit sophistication. COMPARISON: The 'critical' vendor classification vs. 7.3 CVSS discrepancy suggests vendor concern about prevalence (FTP is widely deployed on legacy systems), not necessarily exploitability. EPSS data would clarify probability, but public PoC + network vector + no auth = HIGH real-world exploitation probability. PRIORITY: Critical for organizations running FreeFloat 1.0 or unpatched versions; moderate for those with FTP disabled or properly firewalled.

An attacker scans the internet for port 21 (FTP) and identifies a FreeFloat FTP Server 1.0 instance. Without authentication, the attacker sends a crafted FTP RESTART command with a buffer-overflow payload (e.g., REST followed by 5000+ bytes of data). The vulnerable command handler in FreeFloat attempts to copy this payload into a fixed-size stack buffer without bounds checking. The overflow corrupts adjacent stack memory, causing either: (1) immediate crash (denial of service), (2) leak of sensitive data from memory (credentials, file paths), or (3) in a sophisticated exploit, overwrite of the return address to execute arbitrary code on the server. The attacker repeats this against multiple targets, achieving widespread FTP service outages or data exfiltration. Because the vulnerability requires no authentication and is network-accessible, automated mass exploitation is feasible. With public PoC code available, even unsophisticated attackers can execute this attack via simple FTP client automation or raw socket scripts.