EUVD-2025-16816Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) indicates network-accessible attack surface with low complexity and no privilege or user interaction required, which maximizes exploitability. The individual impact scores (L/L/L) suggest the vulnerability provides limited but meaningful impact across all three security pillars. Public POC availability significantly elevates real-world risk by lowering the barrier to exploitation for unsophisticated attackers. The vulnerability should be assessed using SSVC: exploitation is already PUBLIC/ACTIVE (POC disclosed), technical impact is TOTAL (buffer overflow can lead to code execution in FTP server context), and the affected product is likely CRIT/HIGH automatable in environments still running legacy FTP infrastructure. However, FreeFloat FTP Server 1.0 appears to have minimal deployment footprint in modern environments, suggesting this is a legacy system risk rather than widespread infrastructure threat. Organizations still operating this ancient FTP server should prioritize immediate patching or deprecation; however, the practical attack surface may be limited by reduced deployment prevalence. |
| Exploit ScenarioDerived | An unauthenticated attacker on an external network identifies a system running FreeFloat FTP Server 1.0 (e.g., via port scanning or banner grabbing on port 21). The attacker constructs a malicious PASV command with an oversized payload that overflows the command handler's buffer. Due to low attack complexity and no authentication requirement, the attacker can trigger the overflow without prior interaction. The buffer overflow overwrites adjacent memory (stack or heap), potentially corrupting the FTP server process and achieving a denial of service crash, or in optimized scenarios with proper payload crafting, redirecting program flow to attacker-supplied shellcode for remote code execution within the server's privilege context. Public POC code likely contains pre-built payloads that automate this process, enabling even non-expert attackers to weaponize the vulnerability at scale against unpatched systems. The attack requires only network connectivity to port 21 and no special tools beyond a standard FTP client or raw socket manipulation library. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 14, 2026
Critical buffer overflow vulnerability in the PASV command handler of FreeFloat FTP Server 1.0 that allows unauthenticated remote attackers to cause denial of service and potentially achieve code execution with limited impact on confidentiality and integrity. The vulnerability has been publicly disclosed with exploit code available, making it immediately actionable for threat actors. While the CVSS score of 7.3 reflects moderate severity, the combination of remote exploitability, public POC availability, and lack of authentication requirements positions this as a high-priority remediation target.
RemediationAI
Immediate remediation steps: (1) Identify all systems running FreeFloat FTP Server 1.0 and prepare for decommissioning or upgrade; (2) Check the FreeFLOAT vendor website (www.freefloat.com) for available patches or security advisories—verify if version 1.0 is still supported; (3) If patched versions exist (1.1 or later), upgrade immediately; (4) If no patches are available, the product is likely end-of-life and should be replaced with a maintained FTP server alternative (e.g., vsftpd, ProFTPD, or Pure-FTPd with current security patches). Interim mitigation: (5) Restrict network access to the FTP service using firewall rules to allow only trusted internal networks or IP ranges; (6) Disable PASV mode if not required for operational use, configuring clients to use PORT mode only; (7) Run the FTP service in a sandboxed/containerized environment to limit buffer overflow impact. Given the legacy nature of this product, deprecation in favor of modern, actively-maintained alternatives is strongly recommended over extended mitigation efforts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
FreeFloat FTP Server 1.0 implements the File Transfer Protocol (FTP) with a vulnerable PASV (Passive Mode) command handler. The PASV command is a standard FTP mechanism that instructs the server to enter passive mode for data transfer, returning an IP address and port for the client to connect to. The vulnerability manifests as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), a classic buffer overflow condition where user-supplied input from the PASV command is insufficiently validated before being written to a fixed-size buffer. This allows an attacker to overflow the buffer, overwrite adjacent memory structures, and potentially redirect program execution flow. The affected product is specifically FreeFloat FTP Server version 1.0 (CPE: cpe:2.3:a:freefloat:freefloat_ftp_server:1.0:*:*:*:*:*:*:*), which appears to be a legacy or discontinued product with minimal community support.
Know when Freefloat Ftp Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability has been found in FreeFloat FTP Server 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the component PASV Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Executive ViewAI
FreeFloat FTP Server 1.0 contains a critical buffer overflow vulnerability in its PASV command handler that allows remote attackers to execute code without authentication. Organizations using this legacy FTP server are at immediate risk of system compromise, data theft, and operational disruption, particularly since a public exploit exists and no patch is available from the vendor.
- Disable PASV mode and restrict FTP to PORT mode only if operationally feasible. 2) Implement strict network segmentation—restrict FTP server access to specific trusted internal IPs using firewall rules. 3) Deploy WAF/IDS rules to detect and block PASV command buffer overflow payloads. 4) Monitor FTP logs for anomalous PASV command patterns. 5) Consider air-gapping the FTP server or taking it offline pending migration. 6) If the server must remain operational, disable remote access entirely and use only for local/VPN-connected transfers.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Freefloat Ftp Server
View allA stack-based buffer overflow vulnerability exists in FreeFloat FTP Server version 1.0.0. Rated medium severity (CVSS 6.
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Stack-based buffer overflow in FreeFloat FTP Server 1.0 allows remote authenticated users to execute arbitrary code via
Critical buffer overflow vulnerability in the NOOP Command Handler of FreeFloat FTP Server 1.0 that allows remote, unaut
A vulnerability was found in FreeFloat FTP Server 1.0 and classified as problematic. Rated high severity (CVSS 7.5), thi
Critical buffer overflow vulnerability in FreeFloat FTP Server 1.0's REIN Command Handler that allows unauthenticated re
Critical buffer overflow vulnerability in the XMKD Command Handler of FreeFloat FTP Server 1.0 that allows unauthenticat
Critical buffer overflow vulnerability in the XCWD Command Handler of FreeFloat FTP Server 1.0 that allows unauthenticat
Critical buffer overflow vulnerability in the RESTART Command Handler of FreeFloat FTP Server 1.0 that allows unauthenti
Critical buffer overflow vulnerability in FreeFloat FTP Server 1.0 affecting the REGET command handler, allowing unauthe
Critical buffer overflow vulnerability in the PROGRESS Command Handler of FreeFloat FTP Server 1.0 that allows unauthent
Critical buffer overflow vulnerability in the SET Command Handler of FreeFloat FTP Server 1.0 that allows unauthenticate
GitHub PoC
Exploit-DB