EUVD-2025-16815
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
4Description
A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0. Affected is an unknown function of the component NOOP Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Analysis
Critical buffer overflow vulnerability in the NOOP Command Handler of FreeFloat FTP Server 1.0 that allows remote, unauthenticated attackers to achieve arbitrary code execution or cause denial of service. The vulnerability has been publicly disclosed with working exploits available, and while the CVSS score of 7.3 indicates moderate severity, the combination of remote exploitability, lack of authentication requirements, and confirmed public disclosure elevates real-world risk significantly.
Technical Context
FreeFloat FTP Server 1.0 implements an FTP (File Transfer Protocol) daemon with a NOOP (No Operation) command handler that improperly validates input buffer lengths. The vulnerability is rooted in CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), a classic stack or heap buffer overflow condition. When processing NOOP commands, the server fails to enforce proper bounds checking on command arguments, allowing an attacker to write beyond allocated memory regions. This affects the FTP control channel protocol (typically TCP port 21) where command parsing occurs. The affected CPE would be cpe:2.3:a:freefloat:freefloat_ftp_server:1.0, with all installation variants vulnerable regardless of configuration.
Affected Products
FreeFloat FTP Server (['1.0'])
Remediation
Contact FreeFloat vendor to determine if any patched version exists; if no vendor support available, product should be discontinued Workaround: Implement network-level ACLs to limit connections to port 21/TCP to trusted sources only Mitigation: Configure intrusion detection/prevention systems to monitor for FTP NOOP command overflow patterns Long-term: Inventory all systems running FreeFloat FTP Server 1.0 and migrate to supported alternatives
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today