Freefloat Ftp Server CVE-2025-5666

Multiple risk signals converge to indicate HIGH real-world risk: (1) Attack Vector is Network with no authentication required and Low complexity (AV:N/AC:L/PR:N), making exploitation trivial; (2) Public exploit availability and disclosed vulnerability status significantly lower barriers to weaponization; (3) CVSS 7.3 is elevated and within the critical range for many organizational risk frameworks; (4) Buffer overflow vulnerabilities in network-facing FTP services typically enable remote code execution, despite CVSS showing only partial impact (C:L/I:L/A:L, likely a conservative assessment); (5) FreeFloat FTP Server appears to be legacy/abandoned software with slow patch cycles, increasing exposure windows. The main mitigating factor is that FTP deployments are declining, reducing the exposed asset base, but organizations still using this software face urgent risk. This is NOT a 'high CVSS, low real risk' case—it represents a genuine critical vulnerability in network-exposed legacy software.

An attacker with network access to an FTP server running FreeFloat FTP Server 1.0 connects to the standard FTP control port (TCP 21) without authentication. The attacker sends a crafted XMKD command with an excessively long directory name payload (e.g., 'XMKD /path/with/1000+byte/overflow/buffer/exploit') that exceeds the allocated buffer in the XMKD handler. The buffer overflow corrupts the stack or heap, overwriting function pointers or return addresses with attacker-controlled shellcode address. Upon command completion or next function call, execution jumps to the shellcode, granting the attacker remote code execution on the server with the privileges of the FTP service process (typically SYSTEM on Windows or root on poorly configured Linux systems). This could enable data exfiltration, malware installation, lateral movement, or complete server compromise. Publicly available POC code removes the need for custom exploit development, lowering the skill barrier for attackers.