EUVD-2025-16895
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
4Description
A vulnerability has been found in FreeFloat FTP Server 1.0 and classified as critical. This vulnerability affects unknown code of the component SET Command Handler. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Analysis
Critical buffer overflow vulnerability in the SET Command Handler of FreeFloat FTP Server 1.0 that allows unauthenticated remote attackers to trigger memory corruption with potential for code execution or service disruption. The vulnerability has been publicly disclosed with exploit code available, increasing immediate risk of active exploitation in the wild. With a CVSS score of 7.3 and network-accessible attack vector requiring no privileges or user interaction, this represents a significant threat to any FTP infrastructure running the affected version.
Technical Context
FreeFloat FTP Server 1.0 contains an input validation flaw in its SET command handler component, which fails to properly bounds-check user-supplied data before writing to a fixed-size buffer. This is a classic stack-based or heap-based buffer overflow (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer), a memory safety violation that allows attackers to overwrite adjacent memory regions. The FTP protocol's command-based architecture means the SET command is directly accessible over the network without prior authentication, making this trivially reachable. The vulnerability likely resides in the command parsing logic where the handler processes arguments without adequate length validation before copying them into an internal buffer.
Affected Products
FreeFloat FTP Server (['1.0'])
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today