EUVD-2025-17003
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
4Description
A vulnerability was found in FreeFloat FTP Server 1.0. It has been classified as critical. Affected is an unknown function of the component XCWD Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Analysis
Critical buffer overflow vulnerability in the XCWD Command Handler of FreeFloat FTP Server 1.0 that allows unauthenticated remote attackers to cause denial of service and potentially achieve code execution with confidentiality, integrity, and availability impact. The vulnerability has been publicly disclosed with exploit code available, making it an active threat to exposed FTP server instances. With a CVSS score of 7.3 and network-based attack vector requiring no privileges or user interaction, this represents a significant risk to unpatched deployments.
Technical Context
FreeFloat FTP Server 1.0 contains a buffer overflow vulnerability (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer) in its XCWD (Extended Change Working Directory) command handler component. The XCWD command is part of the FTP protocol specification and is used to change the server's working directory. The vulnerability arises from insufficient input validation and bounds checking when processing XCWD command arguments, allowing an attacker to write beyond allocated buffer boundaries. CWE-119 is a classic memory safety issue that can lead to stack corruption, heap corruption, or code execution depending on memory layout and exploitation technique. The affected product CPE is likely 'cpe:2.3:a:freefloat:ftp_server:1.0:*:*:*:*:*:*:*' based on the vendor and version information provided.
Affected Products
FreeFloat FTP Server version 1.0 is the confirmed affected product. The vulnerability impacts: Product: FreeFloat FTP Server, Version: 1.0, Vendor: FreeFloat, Component: XCWD Command Handler. This is legacy software with limited current deployment but remains in use in embedded systems, legacy Windows environments, and specialized industrial applications. No newer versions or patch information has been disclosed in available references, suggesting either end-of-life status or delayed vendor response. CPE representation: 'cpe:2.3:a:freefloat:ftp_server:1.0:*:*:*:*:*:*:*'. Any system running this exact version with the FTP service accessible is vulnerable.
Remediation
Immediate remediation options: (1) PATCH: Upgrade from FreeFloat FTP Server 1.0 to a patched version if available from the vendor; however, no patched version has been publicly announced as of this analysis—contact FreeFloat directly for patch availability and timeline. (2) NETWORK ISOLATION: Disable or restrict FTP access by implementing firewall rules to block inbound FTP connections (ports 20-21) from untrusted networks; allow only necessary internal connections. (3) SERVICE REPLACEMENT: Migrate to actively maintained FTP server alternatives (e.g., vsftpd on Linux, ProFTPD, IIS FTP on Windows) with modern security practices. (4) TEMPORARY MITIGATION: If immediate migration is not feasible, disable XCWD command support via server configuration if such options exist, or implement command filtering at the firewall level. (5) MONITORING: Deploy IDS/IPS rules to detect XCWD command buffer overflow attempts (excessive argument lengths). Recommended priority: Replace or isolate the server within 48-72 hours.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today