CVE-2025-4847
📋 TL;DR
A critical buffer overflow vulnerability in FreeFloat FTP Server 1.0's MLS command handler allows remote attackers to execute arbitrary code or crash the service. This affects all deployments of FreeFloat FTP Server 1.0 with the MLS command enabled. Attackers can exploit this without authentication over the network.
💻 Affected Systems
- FreeFloat FTP Server
📦 What is this software?
Ftp Server by Freefloat
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and lateral movement within the network.
Likely Case
Service crash causing denial of service, with potential for remote code execution if exploit is weaponized.
If Mitigated
Service disruption or crash, but no further compromise due to network segmentation and least privilege controls.
🎯 Exploit Status
Public exploit code is available, making weaponization straightforward. The buffer overflow in MLS command handler requires minimal attacker skill to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: N/A
Restart Required: No
Instructions:
No official patch available. FreeFloat FTP Server appears to be abandoned software. Migrate to a supported FTP server solution.
🔧 Temporary Workarounds
Disable MLS command
windowsDisable the vulnerable MLS command in FreeFloat FTP Server configuration
Edit configuration file to remove or disable MLS command support
Network segmentation
allRestrict access to FTP server to only trusted networks
Configure firewall rules to allow FTP (port 21) only from required IP ranges
🧯 If You Can't Patch
- Replace FreeFloat FTP Server with a maintained alternative like FileZilla Server, vsftpd, or ProFTPD
- Implement strict network access controls and monitor for exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check if FreeFloat FTP Server 1.0 is installed and running. Verify MLS command is enabled in configuration.Check Version:
Check FreeFloat FTP Server interface or configuration files for version informationVerify Fix Applied:
Verify FreeFloat FTP Server has been removed or replaced with alternative software. Test that MLS command is no longer available.📡 Detection & Monitoring
Log Indicators:
- Multiple failed MLS command attempts
- Unusual buffer overflow patterns in FTP logs
- Service crash/restart events
Network Indicators:
- Excessive or malformed MLS commands to FTP port 21
- Buffer overflow patterns in FTP traffic
SIEM Query:
source="ftp.log" AND (command="MLS" OR "buffer overflow" OR "access violation")