CVE-2025-5073
📋 TL;DR
A critical buffer overflow vulnerability in FreeFloat FTP Server 1.0 allows remote attackers to execute arbitrary code or crash the service by sending specially crafted MKDIR commands. This affects all deployments of FreeFloat FTP Server 1.0 with the vulnerable component enabled. Attackers can exploit this without authentication to potentially gain control of affected systems.
💻 Affected Systems
- FreeFloat FTP Server
📦 What is this software?
Ftp Server by Freefloat
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Service disruption through denial of service (crash) or limited code execution in the context of the FTP server process.
If Mitigated
Service crash only if memory protections (ASLR/DEP) prevent successful code execution.
🎯 Exploit Status
Public exploit code is available, making this easily weaponizable by attackers with basic skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: N/A
Restart Required: No
Instructions:
No official patch exists. Consider migrating to a supported, actively maintained FTP server solution.
🔧 Temporary Workarounds
Disable MKDIR command
windowsConfigure FreeFloat FTP Server to reject or disable MKDIR commands entirely.
Edit FreeFloat FTP Server configuration to remove MKDIR from allowed commands
Network segmentation
windowsRestrict access to FTP server to trusted IP addresses only using firewall rules.
netsh advfirewall firewall add rule name="Block FTP Except Trusted" dir=in action=block protocol=TCP localport=21 remoteip=!192.168.1.0/24,10.0.0.0/8 enable=yes
🧯 If You Can't Patch
- Replace FreeFloat FTP Server with a modern, supported alternative like FileZilla Server, vsftpd, or ProFTPD.
- Implement application-level firewall or WAF rules to block MKDIR commands containing suspicious patterns or excessive length.
🔍 How to Verify
Check if Vulnerable:
Check if FreeFloat FTP Server version 1.0 is installed and running on port 21/TCP.Check Version:
Check program files directory for FreeFloat FTP Server executable and properties, or review installed programs list.Verify Fix Applied:
Verify that FreeFloat FTP Server is no longer in use or has been replaced with a different FTP server.📡 Detection & Monitoring
Log Indicators:
- Multiple failed MKDIR commands with long directory names
- FTP server crash logs or unexpected service termination
Network Indicators:
- Unusual FTP traffic patterns with long MKDIR commands
- Exploit kit traffic targeting port 21/TCP
SIEM Query:
source="ftp.log" AND command="MKDIR" AND (length(dirname) > 100 OR dirname contains "\x90" OR dirname contains "\xcc")