Ftp Server EUVD-2025-16872

The risk assessment reveals a significant real-world threat despite the CVSS 7.3 score being moderate rather than critical. Key risk signals: (1) CVSS vector AV:N/AC:L/PR:N/UI:N indicates network-exploitable, no authentication required, no user interaction needed—maximum ease of exploitation; (2) Public disclosure and available exploits (POC exists per description) means attackers have weaponized code; (3) Buffer overflow vulnerabilities in network-facing daemons are highly automatable and can lead to remote code execution despite the CVSS showing only L/L/L impact ratings; (4) Legacy software (FreeFloat FTP Server 1.0 is extremely old, likely 1990s-era) means many deployed instances lack modern protections like ASLR, DEP/NX bit enforcement, or stack canaries, increasing exploit reliability. The moderate CVSS undersells the danger—this is a wormable, remotely exploitable unauthenticated network service with functional exploits in the wild. EPSS score (not provided but estimated high given POC+network exploitable+legacy target) and KEV listing would further confirm active exploitation. SSVC perspective: exploitation is public (active), highly automatable (network fuzz), technical impact is code execution potential (high)—this should be treated as CRITICAL for any affected deployment.

An attacker performs network reconnaissance and identifies a server running FreeFloat FTP Server 1.0 on port 21. The attacker crafts a malicious PASSIVE command with an oversized payload that overflows the buffer allocated for storing passive mode connection parameters (e.g., IP address and port tuple). Because the vulnerability requires no authentication (PR:N in CVSS), the attacker sends this malformed command immediately after connecting. The buffer overflow corrupts the stack, overwriting a stored return address with attacker-supplied shellcode address. Upon function return, execution transfers to the attacker's injected code, establishing a reverse shell or downloading/executing a remote payload. The attack succeeds in seconds with minimal interaction; public POC tools automate the entire process. A single successful compromise can lead to lateral movement within the network, especially in legacy environments lacking segmentation.