CVE-2024-0693: Easy File Sharing FTP Server DoS Flaw

CVE-2024-0693 Overview

CVE-2024-0693 is a remotely exploitable denial of service vulnerability in EFS Easy File Sharing FTP Server 2.0. The flaw resides in the FTP authentication handler, where manipulation of the username argument triggers improper resource shutdown or release [CWE-404]. An unauthenticated attacker can send a crafted FTP login request over the network to crash the service, interrupting file sharing operations for all connected users. The vulnerability has been publicly disclosed under VulDB identifier VDB-251479, with proof-of-concept material released on third-party exploit platforms. The vendor was contacted prior to disclosure but did not respond, and no official patch has been published.

Critical Impact
Unauthenticated remote attackers can crash the Easy File Sharing FTP Server 2.0 service by submitting a malformed username value, disrupting availability of hosted file shares.

Affected Products

EFS Easy File Sharing FTP Server 2.0
CPE: cpe:2.3:a:easy_file_sharing_ftp_server_project:easy_file_sharing_ftp_server:2.0
Deployments exposing TCP/21 to untrusted networks

Discovery Timeline

2024-01-18 - CVE-2024-0693 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0693

Vulnerability Analysis

The vulnerability is classified under [CWE-404] Improper Resource Shutdown or Release. When an attacker connects to the FTP service and submits a specially crafted USER command, the server fails to properly handle the supplied data and terminates abnormally. The defect lies in the authentication routine that processes the username argument before credentials are validated, which means no prior authentication is required to trigger the condition.

Because the impact is limited to availability, the flaw does not expose data or allow code execution. However, repeated exploitation prevents legitimate users from reaching the file share. The product is end-of-life and unmaintained, so the attack surface remains unchanged across all installations of version 2.0.

Root Cause

The root cause is the absence of input validation and bounds checking on the username parameter passed to the FTP login handler. The server allocates or references resources tied to the supplied value, then fails to release them safely when malformed input is processed, causing the daemon to abort.

Attack Vector

The attack originates over the network against the FTP listener, typically TCP/21. An attacker establishes a standard FTP control connection and issues a USER command containing a malformed or oversized argument. No credentials, user interaction, or elevated privileges are required, making the issue trivial to weaponize against exposed instances.

A public proof-of-concept describing the malformed USER sequence has been documented on 0day.today exploit description #39218 and Packet Storm Security. Refer to those references for the exact byte-level reproduction details.

Detection Methods for CVE-2024-0693

Indicators of Compromise

Unexpected termination or repeated restarts of the fsftp.exe (or equivalent) Easy File Sharing FTP Server process
FTP control sessions from unknown source IPs that issue a single anomalous USER command and immediately drop
Sudden loss of TCP/21 listener availability followed by reconnection attempts from legitimate clients
Windows Application or System event log entries showing the FTP service crashing with access violation faults

Detection Strategies

Inspect FTP traffic for USER commands containing unusually long, non-ASCII, or malformed argument payloads
Correlate FTP service crashes with inbound connections from external IP ranges using network and host telemetry
Alert on rapid service restarts of the Easy File Sharing FTP Server binary within short time windows

Monitoring Recommendations

Forward FTP server logs and Windows service state changes to a central SIEM or data lake for correlation
Enable network-level capture on TCP/21 in front of any remaining Easy File Sharing FTP deployments to retain crash-triggering payloads for forensic review
Track service uptime metrics and trigger alerts when the FTP daemon restarts more than a defined threshold per hour

How to Mitigate CVE-2024-0693

Immediate Actions Required

Remove Easy File Sharing FTP Server 2.0 from internet-exposed segments and restrict access to trusted management networks only
Migrate hosted file shares to a maintained FTP or SFTP platform that receives security updates
Place an upstream firewall or reverse proxy in front of the FTP listener to drop malformed USER commands
Monitor the FTP service process for crashes and configure automatic restart with alerting

Patch Information

No vendor patch is available. The vendor was contacted prior to public disclosure but did not respond, and Easy File Sharing FTP Server 2.0 appears to be unmaintained. Organizations should treat the software as end-of-life and plan replacement. Additional references include the VulDB entry for VDB-251479.

Workarounds

Block inbound TCP/21 at the perimeter firewall for any host running the affected version
Restrict FTP access to specific source IP allowlists using host-based firewall rules
Disable the Easy File Sharing FTP service when not actively required and start it only for scheduled transfers
Deploy a network intrusion prevention signature that drops FTP USER commands exceeding expected length boundaries

bash

# Windows firewall example: block inbound FTP except from a trusted management subnet
netsh advfirewall firewall add rule name="Block FTP Inbound" ^
  dir=in action=block protocol=TCP localport=21

netsh advfirewall firewall add rule name="Allow FTP Mgmt Subnet" ^
  dir=in action=allow protocol=TCP localport=21 ^
  remoteip=10.10.0.0/24