EUVD-2025-16958
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
4Description
A vulnerability classified as critical was found in PCMan FTP Server 2.0.7. This vulnerability affects unknown code of the component PLS Command Handler. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Analysis
Critical buffer overflow vulnerability in PCMan FTP Server 2.0.7 affecting the PLS Command Handler component. Remote attackers can exploit this flaw without authentication or user interaction to achieve confidentiality, integrity, and availability impacts. Public exploit code is available and the vulnerability may be actively exploited in the wild.
Technical Context
PCMan FTP Server is a lightweight FTP (File Transfer Protocol) server implementation. The vulnerability exists in the PLS Command Handler—a component responsible for parsing and processing the PLS protocol command. The root cause is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), a classic buffer overflow vulnerability where untrusted input from remote FTP clients is not properly validated before being written to a fixed-size buffer. This allows an attacker to overflow the buffer, potentially corrupting adjacent memory, executing arbitrary code, or causing denial of service. The attack vector is network-based (AV:N) with low attack complexity (AC:L), requiring no authentication (PR:N) or user interaction (UI:N), making exploitation straightforward.
Affected Products
- product: PCMan FTP Server; vendor: PCMan Project; affected_version: 2.0.7; affected_component: PLS Command Handler; cpe: cpe:2.3:a:pcman_project:pcman_ftp_server:2.0.7:*:*:*:*:*:*:*; status: Vulnerable
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today