CVE-2025-3373
📋 TL;DR
A critical buffer overflow vulnerability in PCMan FTP Server 2.0.7 allows remote attackers to execute arbitrary code or crash the service by sending specially crafted SITE CHMOD commands. This affects all systems running the vulnerable FTP server version. The exploit is publicly available and can be launched without authentication.
💻 Affected Systems
- PCMan FTP Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment
Likely Case
Service disruption through denial of service, potential remote code execution in default configurations
If Mitigated
Limited to service disruption if proper network segmentation and exploit prevention controls are in place
🎯 Exploit Status
Public exploit code is available at the provided reference URL. The vulnerability requires no authentication and has straightforward exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative FTP server software or implementing workarounds.
🔧 Temporary Workarounds
Disable SITE CHMOD command
windowsConfigure FTP server to reject or disable SITE CHMOD commands if supported by server configuration
Network filtering
allBlock FTP traffic at network perimeter or implement IPS rules to detect and block malicious SITE CHMOD commands
🧯 If You Can't Patch
- Immediately remove PCMan FTP Server 2.0.7 from internet-facing systems
- Implement strict network segmentation to isolate FTP servers from critical systems
🔍 How to Verify
Check if Vulnerable:
Check FTP server version in application interface or configuration files. Version 2.0.7 is vulnerable.Check Version:
Check server interface or configuration files for version informationVerify Fix Applied:
Verify server has been upgraded to a non-vulnerable version or removed from service📡 Detection & Monitoring
Log Indicators:
- Multiple failed SITE CHMOD commands
- Unusual SITE CHMOD command patterns with long parameters
- FTP service crashes
Network Indicators:
- FTP traffic containing SITE CHMOD commands with unusually long parameters
- Multiple connection attempts to FTP port 21
SIEM Query:
source="ftp.log" AND (command="SITE" AND parameter="CHMOD") AND length(parameter_value) > 100