CVE-2025-3723
📋 TL;DR
A critical buffer overflow vulnerability in PCMan FTP Server 2.0.7 allows remote attackers to execute arbitrary code or crash the service by exploiting the MDTM command handler. This affects all systems running the vulnerable FTP server version. Attackers can exploit this without authentication from remote networks.
💻 Affected Systems
- PCMan FTP Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment
Likely Case
Service disruption through denial of service, with potential for remote code execution by skilled attackers
If Mitigated
Limited to service disruption if proper network segmentation and exploit prevention controls are in place
🎯 Exploit Status
Public exploit code is available, making exploitation straightforward for attackers
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a different FTP server solution or implementing workarounds.
🔧 Temporary Workarounds
Disable FTP Service
windowsStop and disable the PCMan FTP Server service
sc stop "PCMan FTP Server"
sc config "PCMan FTP Server" start= disabled
Network Segmentation
windowsBlock FTP port 21 at network perimeter
netsh advfirewall firewall add rule name="Block FTP" dir=in action=block protocol=TCP localport=21
🧯 If You Can't Patch
- Replace PCMan FTP Server with a maintained alternative like FileZilla Server or vsftpd
- Implement strict network access controls to limit FTP server exposure to trusted IPs only
🔍 How to Verify
Check if Vulnerable:
Check if PCMan FTP Server version 2.0.7 is installed via Programs and Features or by examining the service propertiesCheck Version:
wmic product where "name like 'PCMan%'" get versionVerify Fix Applied:
Verify service is stopped/disabled or that FTP port 21 is blocked📡 Detection & Monitoring
Log Indicators:
- Multiple MDTM command failures
- FTP service crash events
- Unusual buffer overflow errors in application logs
Network Indicators:
- Excessive MDTM commands to FTP server
- Malformed FTP commands with long parameters
SIEM Query:
source="ftp.log" AND command="MDTM" AND (length(param) > 100 OR status="500")