Ftp EUVD-2025-16966

The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L vector indicates high exploitability: the attack is network-accessible (AV:N), requires no special conditions (AC:L), no authentication (PR:N), and no user interaction (UI:N). The CVSS base score of 7.3 reflects moderate-to-high impact. The presence of public exploit code and public disclosure significantly elevates real-world risk, as attack tools are immediately available to threat actors and automated scanners. The vulnerability is likely to receive immediate attention from both defensive and offensive security communities. Exploitation does not require privilege escalation (PR:N) and can be performed by unauthenticated remote users, making this a 'wormable' attack vector if deployed widely. The buffer overflow could potentially enable arbitrary code execution (not just DoS), which would justify the 'critical' classification, despite the CVSS score being 7.3 rather than 9+. Organizations with internet-facing FTP services are at immediate risk. The ACL (AC:L) indicates no special attack conditions are needed—any attacker with network access can trigger the overflow. Given public POC availability and network accessibility, this should be treated as an urgent priority.

An attacker performs network reconnaissance and identifies a PCMan FTP Server 2.0.7 instance running on port 21 (standard FTP). The attacker sends a specially crafted FTP command: 'SET [LONG_BUFFER_OF_1000+_BYTES]' without authentication. The SET command handler reads the argument into a fixed-size buffer (e.g., 256 bytes) without length validation. The overflow overwrites the stack, potentially corrupting the function return address. In a best-case scenario for the attacker, they craft the payload to include shellcode that executes arbitrary commands on the server (e.g., creating a backdoor account, exfiltrating data). In a minimum case, the overflow causes the server to crash (denial of service). Because the FTP service typically runs with high privileges and handles untrusted network input, successful exploitation could grant remote code execution. The attack requires only network access and can be fully automated, making it attractive for mass exploitation campaigns, worms, or targeted attacks against organizations running FTP services.