EUVD-2025-16816
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
4Description
A vulnerability has been found in FreeFloat FTP Server 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the component PASV Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Analysis
Critical buffer overflow vulnerability in the PASV command handler of FreeFloat FTP Server 1.0 that allows unauthenticated remote attackers to cause denial of service and potentially achieve code execution with limited impact on confidentiality and integrity. The vulnerability has been publicly disclosed with exploit code available, making it immediately actionable for threat actors. While the CVSS score of 7.3 reflects moderate severity, the combination of remote exploitability, public POC availability, and lack of authentication requirements positions this as a high-priority remediation target.
Technical Context
FreeFloat FTP Server 1.0 implements the File Transfer Protocol (FTP) with a vulnerable PASV (Passive Mode) command handler. The PASV command is a standard FTP mechanism that instructs the server to enter passive mode for data transfer, returning an IP address and port for the client to connect to. The vulnerability manifests as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), a classic buffer overflow condition where user-supplied input from the PASV command is insufficiently validated before being written to a fixed-size buffer. This allows an attacker to overflow the buffer, overwrite adjacent memory structures, and potentially redirect program execution flow. The affected product is specifically FreeFloat FTP Server version 1.0 (CPE: cpe:2.3:a:freefloat:freefloat_ftp_server:1.0:*:*:*:*:*:*:*), which appears to be a legacy or discontinued product with minimal community support.
Affected Products
- product: FreeFloat FTP Server; version: 1.0; cpe: cpe:2.3:a:freefloat:freefloat_ftp_server:1.0:*:*:*:*:*:*:*; status: Vulnerable
Remediation
Immediate remediation steps: (1) Identify all systems running FreeFloat FTP Server 1.0 and prepare for decommissioning or upgrade; (2) Check the FreeFLOAT vendor website (www.freefloat.com) for available patches or security advisories—verify if version 1.0 is still supported; (3) If patched versions exist (1.1 or later), upgrade immediately; (4) If no patches are available, the product is likely end-of-life and should be replaced with a maintained FTP server alternative (e.g., vsftpd, ProFTPD, or Pure-FTPd with current security patches). Interim mitigation: (5) Restrict network access to the FTP service using firewall rules to allow only trusted internal networks or IP ranges; (6) Disable PASV mode if not required for operational use, configuring clients to use PORT mode only; (7) Run the FTP service in a sandboxed/containerized environment to limit buffer overflow impact. Given the legacy nature of this product, deprecation in favor of modern, actively-maintained alternatives is strongly recommended over extended mitigation efforts.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today