CVE-2025-3379
📋 TL;DR
A critical buffer overflow vulnerability in PCMan FTP Server 2.0.7 allows remote attackers to execute arbitrary code or crash the service by sending specially crafted EPSV commands. This affects all systems running the vulnerable FTP server version. The vulnerability is remotely exploitable without authentication.
💻 Affected Systems
- PCMan FTP Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Service crash causing denial of service, potentially followed by remote code execution if exploit is weaponized.
If Mitigated
Service disruption but no system compromise if proper network segmentation and exploit prevention controls are active.
🎯 Exploit Status
Public exploit code is available, making weaponization likely. The vulnerability requires no authentication and has low exploitation complexity.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative FTP server software or implementing workarounds.
🔧 Temporary Workarounds
Disable EPSV command
windowsConfigure FTP server to reject EPSV commands if supported by configuration.
Network filtering
allBlock EPSV commands at network perimeter using IPS/IDS or firewall rules.
🧯 If You Can't Patch
- Isolate FTP server in segmented network with strict access controls
- Implement application whitelisting to prevent execution of unauthorized code
🔍 How to Verify
Check if Vulnerable:
Check if PCMan FTP Server version 2.0.7 is installed and running. Use netstat to check for FTP service on port 21.Check Version:
Check program files directory for PCMan FTP Server and examine version in properties or about dialog.Verify Fix Applied:
Verify FTP server version is no longer 2.0.7 or service has been disabled/removed.📡 Detection & Monitoring
Log Indicators:
- Multiple EPSV command attempts
- FTP service crash logs
- Unusual process creation from FTP service
Network Indicators:
- EPSV commands with unusually long parameters
- Traffic patterns matching known exploit
SIEM Query:
source="ftp.log" AND (command="EPSV" OR "buffer overflow")