EUVD-2025-16796
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
4Description
A vulnerability, which was classified as critical, has been found in FreeFloat FTP Server 1.0. This issue affects some unknown processing of the component CDUP Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Analysis
Critical buffer overflow vulnerability in FreeFloat FTP Server 1.0 affecting the CDUP (Change Directory Up) command handler, allowing unauthenticated remote attackers to achieve code execution or denial of service. The vulnerability has been publicly disclosed with exploit code available, and the CVSS 7.3 score reflects moderate-to-high severity with low attack complexity and no privileges required. This is a high-priority issue for organizations running legacy FTP infrastructure, particularly given the remote, unauthenticated attack vector and public exploit availability.
Technical Context
FreeFloat FTP Server 1.0 is a legacy FTP server implementation. The vulnerability exists in the CDUP command handler—a standard FTP command used to navigate up one directory level in the server's file system hierarchy. The root cause is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), a classic buffer overflow condition where input validation on the CDUP command is insufficient, allowing an attacker to write beyond allocated buffer boundaries. The FTP protocol operates over TCP port 21 and accepts commands in plaintext; the CDUP handler's failure to properly bounds-check or sanitize directory traversal input creates a memory safety violation. CPE identifier for affected product: cpe:2.3:a:freefloat:ftp_server:1.0:*:*:*:*:*:*:*. Legacy FTP implementations, particularly those written in unsafe languages (C/C++) without modern buffer protection mechanisms, are commonly vulnerable to this class of overflow.
Affected Products
- product: FreeFloat FTP Server; version: 1.0; cpe: cpe:2.3:a:freefloat:ftp_server:1.0:*:*:*:*:*:*:*; component: CDUP Command Handler; architecture: Unknown (likely x86/x64); notes: Legacy product; no current vendor support expected
Remediation
- action: Immediate Patching; details: Upgrade FreeFloat FTP Server to a patched version. As of the CVE disclosure date (2025), verify latest stable release availability from the vendor. If no patch is available, this product should be considered end-of-life and replaced.; priority: Critical - action: Network Segmentation; details: Restrict FTP (TCP 21) access to trusted IP ranges only via firewall rules. Disable external FTP access if possible; consider VPN-gating or IP whitelisting. FTP should not be directly internet-facing.; priority: High - action: Protocol Migration; details: Migrate from FTP to SFTP (SSH File Transfer Protocol) or FTPS (FTP over TLS). Modern implementations using well-maintained libraries (OpenSSL, libssh2) significantly reduce buffer overflow risk.; priority: High - action: Monitoring & IDS; details: Deploy IDS/IPS signatures to detect malformed CDUP commands with unusually long arguments or payload patterns. Monitor FTP server logs for crash events or unexpected terminations indicating exploitation attempts.; priority: Medium - action: Asset Inventory; details: Scan internal network for FreeFloat FTP Server 1.0 instances using port 21 banners (nmap -sV -p21) or vulnerability scanners (Nessus, OpenVAS). Document business criticality and create remediation timeline.; priority: High - action: If Patching Unavailable; details: Disable CDUP command if server configuration allows selective command filtering. Implement reverse proxy/WAF with CDUP command blocking. Consider running FTP server in a containerized or VM sandbox to limit blast radius.; priority: Medium
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today