CVE-2025-4158
📋 TL;DR
A critical buffer overflow vulnerability in PCMan FTP Server's PROMPT command handler allows remote attackers to execute arbitrary code or crash the service. This affects PCMan FTP Server versions up to 2.0.7. Attackers can exploit this without authentication over the network.
💻 Affected Systems
- PCMan FTP Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment
Likely Case
Service crash causing denial of service, potentially followed by remote code execution
If Mitigated
Service disruption with limited lateral movement if proper network segmentation exists
🎯 Exploit Status
Public exploit code exists, making exploitation straightforward for attackers
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: Yes
Instructions:
No official patch available. Consider migrating to alternative FTP server software or implementing workarounds.
🔧 Temporary Workarounds
Network Access Control
allRestrict access to FTP server using firewall rules
# Windows Firewall: netsh advfirewall firewall add rule name="Block FTP" dir=in action=block protocol=TCP localport=21
# Linux iptables: iptables -A INPUT -p tcp --dport 21 -j DROP
Service Disablement
windowsDisable PCMan FTP Server service
sc stop "PCMan FTP Server"
sc config "PCMan FTP Server" start= disabled
🧯 If You Can't Patch
- Isolate vulnerable systems in separate network segments with strict firewall rules
- Implement application whitelisting to prevent execution of unauthorized code
🔍 How to Verify
Check if Vulnerable:
Check PCMan FTP Server version in About dialog or registry: HKEY_LOCAL_MACHINE\SOFTWARE\PCMan\FTP Server\VersionCheck Version:
reg query "HKLM\SOFTWARE\PCMan\FTP Server" /v VersionVerify Fix Applied:
Verify version is above 2.0.7 or service is disabled/removed📡 Detection & Monitoring
Log Indicators:
- Multiple failed FTP connections
- Unusual PROMPT command usage
- Service crash events in system logs
Network Indicators:
- Excessive FTP traffic to port 21
- Malformed FTP commands in network captures
SIEM Query:
source="*ftp*" AND (event_id=1000 OR event_id=1001) AND process_name="ftpserver.exe"