EUVD-2025-16965
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
4Description
A vulnerability, which was classified as critical, was found in PCMan FTP Server 2.0.7. Affected is an unknown function of the component SYSTEM Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Analysis
Critical buffer overflow vulnerability in PCMan FTP Server 2.0.7's SYSTEM Command Handler that allows unauthenticated remote attackers to cause denial of service and potentially execute arbitrary code with limited impact on confidentiality and integrity. The vulnerability has been publicly disclosed with exploit code available, making it actively exploitable in the wild against unpatched systems.
Technical Context
PCMan FTP Server is a lightweight FTP daemon commonly used on Windows systems. The vulnerability exists in the SYSTEM Command Handler component, which processes FTP protocol commands. The root cause is CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), a classic buffer overflow condition where input from FTP commands is not properly validated before being written to a fixed-size buffer. This allows an attacker to overflow the buffer and potentially overwrite adjacent memory structures, including function pointers or return addresses on the stack. The FTP protocol itself is legacy and unencrypted, making packet inspection and command injection straightforward for attackers. The vulnerability likely resides in command parsing logic where user-supplied parameters in SYSTEM-related FTP commands are copied without bounds checking.
Affected Products
PCMan FTP Server version 2.0.7 and potentially earlier versions. The product identifier would be: cpe:2.3:a:pcman_ftp_server:pcman_ftp_server:2.0.7:*:*:*:*:windows:*:*. Affected systems are primarily Windows-based servers running this legacy FTP daemon. Downstream systems or appliances bundling PCMan FTP Server may also be affected. No vendor advisory URL was provided in the available data, but patches or updates would likely be available from the PCMan FTP Server project repository or official download channels.
Remediation
Immediate remediation steps: (1) Update PCMan FTP Server to the latest patched version beyond 2.0.7 if available from the official vendor; (2) If no patch exists, disable or uninstall PCMan FTP Server and migrate to a modern, maintained FTP server solution (e.g., ProFTPD, vsftpd, or FileZilla Server); (3) If the service must remain operational, implement network-level access controls restricting FTP traffic (TCP port 21) to specific trusted IP addresses only; (4) Monitor FTP server logs for unusual SYSTEM command attempts or buffer overflow attack patterns; (5) Consider replacing FTP entirely with SFTP/SSH, which provides encryption and modern security practices. Workarounds are limited given the nature of buffer overflows, so patching or service replacement is essential.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today