CVE-2025-3377
📋 TL;DR
A critical buffer overflow vulnerability in PCMan FTP Server 2.0.7 allows remote attackers to execute arbitrary code or crash the service by sending specially crafted ENC commands. This affects anyone running the vulnerable FTP server version. The exploit is publicly available and can be triggered without authentication.
💻 Affected Systems
- PCMan FTP Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Service crash causing denial of service, with potential for RCE if exploit is refined.
If Mitigated
Limited to service disruption if exploit fails or is blocked by network controls.
🎯 Exploit Status
Public exploit code exists and attack requires minimal technical skill.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative FTP server software.
🔧 Temporary Workarounds
Disable FTP Service
windowsStop and disable the PCMan FTP Server service
sc stop "PCMan FTP Server"
sc config "PCMan FTP Server" start= disabled
Block ENC Command
allUse network filtering to block ENC commands at firewall level
🧯 If You Can't Patch
- Isolate vulnerable server in separate network segment with strict access controls
- Implement application firewall rules to block malicious FTP commands
🔍 How to Verify
Check if Vulnerable:
Check FTP server version in service properties or about dialog. If version is 2.0.7, it is vulnerable.Check Version:
Check Windows Services for "PCMan FTP Server" propertiesVerify Fix Applied:
Verify service is stopped or uninstalled. Check firewall rules blocking FTP port 21.📡 Detection & Monitoring
Log Indicators:
- Multiple ENC command failures
- FTP service crash events
- Buffer overflow error messages
Network Indicators:
- Unusual ENC command patterns
- Excessive data sent in FTP commands
- Port 21 traffic from suspicious sources
SIEM Query:
source="ftp.log" AND (command="ENC" OR "buffer overflow" OR "access violation")