EUVD-2025-16799
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
4Description
A vulnerability was found in FreeFloat FTP Server 1.0 and classified as critical. Affected by this issue is some unknown functionality of the component PBSZ Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Analysis
Critical buffer overflow vulnerability in FreeFloat FTP Server 1.0's PBSZ Command Handler that allows unauthenticated remote attackers to cause denial of service and potentially achieve code execution with low integrity and confidentiality impact. The vulnerability has been publicly disclosed with exploit code available, increasing real-world exploitation risk; however, the CVSS 7.3 score reflects limited scope and partial confidentiality/integrity impact rather than complete system compromise.
Technical Context
The vulnerability exists in the FTP protocol's PBSZ (Protection Buffer Size) command handler, a mechanism used to negotiate secure data channel parameters in FTP sessions (typically associated with AUTH TLS/SSL extensions per RFC 4217). CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) indicates insufficient input validation on the PBSZ parameter value, causing a classic stack or heap buffer overflow. The FTP protocol itself is inherently insecure and runs on port 21/TCP; the PBSZ command accepts an integer parameter specifying buffer size, which FreeFloat FTP Server 1.0 fails to properly bounds-check before copying to a fixed-size buffer. CPE identifier would be: cpe:2.3:a:freefloat:ftp_server:1.0:*:*:*:*:*:*:* (exact CPE from vendor if available; FreeFloat is a legacy Windows-based FTP server often deployed in legacy environments).
Affected Products
FreeFloat FTP Server version 1.0 (and potentially earlier/later versions if vendor released updates to 1.x series; exact version scope unclear from limited disclosure). Typical deployment: Windows XP/2003/Vista-era systems, legacy embedded appliances, or specialized industrial/SCADA environments still running unsupported FTP infrastructure. No vendor advisory link provided in the CVE data; recommend checking FreeFloat's website (softlookup.com or archived sources) for patch availability. Affected configurations: default installations with FTP service enabled on network-accessible interfaces; PBSZ command processing occurs during or before TLS negotiation in AUTH TLS mode, or during standard protocol negotiation.
Remediation
Primary: Upgrade FreeFloat FTP Server to a patched version if vendor released one (contact FreeFloat/check vendor site for version 1.1+ or replacement); FreeFloat development is defunct/legacy, so patches may not be available—consider migration to maintained FTP server (vsftpd, ProFTPD, IIS FTP on modern Windows). Immediate mitigations: (1) Disable FTP entirely if not required; migrate to SFTP/SCP; (2) Restrict FTP port 21/TCP access via firewall to trusted internal networks only; (3) Run FTP service in a network-isolated or DMZ segment with no direct internet exposure; (4) Implement IDS/IPS rules detecting oversized PBSZ parameter values (e.g., PBSZ values >16MB or non-numeric input); (5) If upgrade path exists, apply immediately; (6) Monitor FTP logs for PBSZ command anomalies or connection drops. No vendor advisory link available; check archived security databases or vendor site directly.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today