CVE-2025-3372
📋 TL;DR
A critical buffer overflow vulnerability in PCMan FTP Server 2.0.7 allows remote attackers to execute arbitrary code by sending specially crafted MKDIR commands. This affects all systems running the vulnerable FTP server version, potentially leading to complete system compromise. The exploit is publicly available and can be launched remotely without authentication.
💻 Affected Systems
- PCMan FTP Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full system compromise, data theft, ransomware deployment, or creation of persistent backdoors.
Likely Case
Remote code execution resulting in system takeover, service disruption, and lateral movement within the network.
If Mitigated
Denial of service or application crash if exploit fails, but code execution remains possible with proper exploitation.
🎯 Exploit Status
Public exploit code is available and requires minimal technical skill to execute. No authentication is required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch is available. Consider migrating to alternative FTP server software or implementing workarounds.
🔧 Temporary Workarounds
Disable MKDIR Command
windowsConfigure FTP server to reject all MKDIR commands if not required for functionality
Configuration depends on FTP server settings interface
Network Segmentation
allIsolate FTP server in separate network segment with strict firewall rules
Configure firewall to restrict FTP access to trusted IPs only
🧯 If You Can't Patch
- Immediately disable or uninstall PCMan FTP Server 2.0.7
- Replace with alternative FTP server software like FileZilla Server, vsftpd, or ProFTPD
🔍 How to Verify
Check if Vulnerable:
Check FTP server version in application interface or About dialog. Version 2.0.7 is vulnerable.Check Version:
Check application properties or About menu in PCMan FTP Server GUIVerify Fix Applied:
Verify PCMan FTP Server is no longer installed or has been replaced with alternative software.📡 Detection & Monitoring
Log Indicators:
- Unusual MKDIR commands with long parameters
- Multiple failed MKDIR attempts
- FTP server crash logs
Network Indicators:
- FTP traffic containing unusually long MKDIR commands
- Multiple connection attempts to FTP port 21
SIEM Query:
source="ftp.log" AND command="MKDIR" AND (length(param) > 100 OR contains(param, "\x90"))