What is the CVSS score of CVE-2025-5666?

CVE-2025-5666 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Freefloat Ftp Server are affected by CVE-2025-5666?

A critical buffer overflow vulnerability in FreeFloat FTP Server 1.0 allows remote attackers to execute arbitrary code with no patch currently available.

Is there a public PoC exploit available for CVE-2025-5666?

Yes, a public proof-of-concept exploit is available for CVE-2025-5666. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2025-5666?

Within 24 hours: Identify all systems running FreeFloat FTP Server 1.0 and isolate them from production networks or disable the FTP service immediately. Within 7 days: Evaluate migration to patched FTP solutions (upgrade to FreeFloat 1.1+ if available, or migrate to alternative FTP servers like ProFTPD, vsftpd, or managed SFTP solutions). Within 30 days: Complete migration away from vulnerable software, implement network segmentation if FTP must remain, and deploy monitoring for exploitation attempts.

Freefloat Ftp Server CVE-2025-5666

EUVD-2025-17006 HIGH

Buffer Overflow (CWE-119)

2025-06-05 cna@vuldb.com

Buffer Overflow Freefloat Ftp Server

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 17:53 euvd

EUVD-2025-17006

Analysis Generated

Mar 14, 2026 - 17:53 vuln.today

PoC Detected

Jun 24, 2025 - 15:22 vuln.today

Public exploit code

CVE Published

Jun 05, 2025 - 16:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was found in FreeFloat FTP Server 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component XMKD Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Critical buffer overflow vulnerability in the XMKD Command Handler of FreeFloat FTP Server 1.0 that allows unauthenticated remote attackers to achieve arbitrary code execution with low-impact consequences (confidentiality, integrity, and availability). The vulnerability has been publicly disclosed with exploit code available, making it a significant risk for exposed FTP deployments; however, the CVSS 7.3 score reflects moderate rather than critical severity due to limited impact scope.

Technical ContextAI

FreeFloat FTP Server 1.0 contains a buffer overflow vulnerability (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer) in its XMKD command handler. The XMKD command is an FTP protocol extension used to create directories on the server. The vulnerability stems from insufficient bounds checking when processing XMKD command arguments, allowing an attacker to write beyond allocated buffer boundaries. This is a classic stack or heap-based buffer overflow that can be triggered via raw FTP protocol communication on the standard FTP control channel (TCP port 21). The attack requires no authentication (PR:N in CVSS vector) and exploits a flaw in how the server parses and processes user-supplied directory names in the XMKD command.

RemediationAI

Specific remediation steps: (1) Immediate: Disable or restrict network access to the FTP service using firewall rules if the service is not critical; (2) Upgrade: Contact FreeFloat vendor for patched versions (version number unknown from provided data—check vendor website for 1.0.1 or later); (3) Compensating controls: Implement network segmentation to limit FTP access to trusted IP ranges only; deploy IDS/IPS rules to detect and block oversized XMKD command arguments; (4) Long-term: Migrate to actively maintained FTP server alternatives (e.g., vsftpd, ProFTPD, Pure-FTPd) with regular security updates. Note: FreeFloat FTP Server appears to be unmaintained legacy software; consider replacement rather than patching if vendor support is unavailable.