CVE-2025-3349
📋 TL;DR
A critical buffer overflow vulnerability in PCMan FTP Server 2.0.7 allows remote attackers to execute arbitrary code by sending a specially crafted SYST command. This affects all systems running the vulnerable FTP server version. Attackers can exploit this without authentication to potentially gain full control of affected systems.
💻 Affected Systems
- PCMan FTP Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, ransomware deployment, or creation of persistent backdoors.
Likely Case
Remote code execution resulting in system compromise, service disruption, and potential lateral movement within the network.
If Mitigated
Denial of service or service crash if exploit fails, but successful exploitation still likely leads to code execution.
🎯 Exploit Status
Public exploit code is available, making exploitation trivial for attackers with basic skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch exists. Consider migrating to alternative FTP server software or implementing workarounds.
🔧 Temporary Workarounds
Network Segmentation
windowsBlock external access to FTP server using firewall rules
netsh advfirewall firewall add rule name="Block FTP" dir=in action=block protocol=TCP localport=21
Disable FTP Service
windowsStop and disable the FTP server service
sc stop "PCMan FTP Server"
sc config "PCMan FTP Server" start= disabled
🧯 If You Can't Patch
- Replace PCMan FTP Server with alternative secure FTP software like FileZilla Server or vsftpd
- Implement strict network access controls to limit FTP server access to trusted IP addresses only
🔍 How to Verify
Check if Vulnerable:
Check if PCMan FTP Server version 2.0.7 is installed and running on port 21/TCPCheck Version:
Check program files directory for PCMan FTP Server installation and version informationVerify Fix Applied:
Verify FTP server is no longer running or has been replaced with alternative software📡 Detection & Monitoring
Log Indicators:
- Multiple failed SYST command attempts
- Unusual buffer overflow errors in FTP logs
- SYST commands with abnormally long parameters
Network Indicators:
- Exploit traffic patterns to FTP port 21
- SYST commands with payload data exceeding normal length
SIEM Query:
source="ftp.log" AND (command="SYST" AND length>50) OR (message="buffer overflow" OR message="access violation")