CVE-2025-3723 Overview
CVE-2025-3723 is a buffer overflow vulnerability in PCMan FTP Server version 2.0.7. The flaw resides in the MDTM command handler component and stems from improper bounds checking on user-supplied input. Remote attackers can send crafted FTP commands to trigger memory corruption without authentication. The exploit has been publicly disclosed, increasing the risk of opportunistic attacks against exposed instances. The vulnerability is classified under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer).
Critical Impact
Unauthenticated remote attackers can corrupt server memory through the MDTM command, potentially leading to denial of service or arbitrary code execution against PCMan FTP Server 2.0.7 instances reachable over the network.
Affected Products
- PCMan FTP Server 2.0.7
- Component: MDTM Command Handler
- Deployments exposing the FTP service over untrusted networks
Discovery Timeline
- 2025-04-16 - CVE-2025-3723 published to NVD
- 2025-05-12 - Last updated in NVD database
Technical Details for CVE-2025-3723
Vulnerability Analysis
The vulnerability affects the MDTM (Modify File Time) command processing routine in PCMan FTP Server 2.0.7. The MDTM command is part of the FTP protocol and allows clients to query or set file modification timestamps on the server. The handler copies attacker-controlled arguments into a fixed-size buffer without validating input length, producing a classic stack-based buffer overflow condition.
The attack does not require authentication on vulnerable configurations where anonymous access is permitted. The exploit document referenced by VulDB has been publicly released, lowering the barrier to weaponization. Successful exploitation can corrupt adjacent stack data including the saved return address, enabling control-flow hijacking.
PCMan FTP Server is a legacy Windows FTP application with a documented history of similar parser vulnerabilities. The product has not received active vendor maintenance, so users running version 2.0.7 should treat the software as unsupported. The vulnerability falls under [CWE-119], reflecting the lack of memory bounds enforcement.
Root Cause
The root cause is the absence of length validation on the argument passed to the MDTM command before copying it into a stack buffer. Standard unsafe C string operations propagate the oversized input without truncation, overwriting return addresses and structured exception handler (SEH) records.
Attack Vector
An attacker establishes a TCP connection to the FTP service and issues a malformed MDTM command with an overlong argument. The malicious payload triggers the overflow during command parsing. The attack vector is network-based, requires low complexity, and needs no privileges or user interaction.
No verified exploitation code is reproduced here. See the Fitoxs Exploit Document and VulDB entry 305069 for the publicly disclosed proof-of-concept details.
Detection Methods for CVE-2025-3723
Indicators of Compromise
- FTP traffic containing MDTM commands with abnormally long arguments, particularly payloads exceeding typical timestamp lengths (14 bytes).
- Unexpected PCManFTPD2.exe process crashes or restarts in Windows Event Logs.
- Outbound connections from the FTP server host immediately following inbound FTP sessions, indicating possible shellcode execution.
- Network flows to TCP port 21 from unknown sources followed by anomalous child process creation on the host.
Detection Strategies
- Deploy network intrusion detection signatures that inspect FTP command streams for MDTM arguments exceeding a reasonable length threshold.
- Monitor endpoint telemetry for PCManFTPD2.exe spawning unexpected child processes such as cmd.exe, powershell.exe, or network utilities.
- Correlate FTP authentication and command logs with process and network behavior to identify exploitation attempts.
Monitoring Recommendations
- Enable verbose FTP server logging and forward logs to a centralized SIEM for retention and analysis.
- Alert on crashes of the FTP service process, which often indicate failed exploitation attempts.
- Track inbound FTP connections from non-corporate IP ranges and apply rate limiting on command volume.
How to Mitigate CVE-2025-3723
Immediate Actions Required
- Discontinue use of PCMan FTP Server 2.0.7 in production environments and migrate to an actively maintained FTP server such as FileZilla Server or vsftpd.
- Restrict access to TCP port 21 on affected hosts using host-based and perimeter firewalls until migration is complete.
- Disable anonymous FTP access where it is not strictly required.
- Inventory all systems running PCMan FTP Server to confirm scope and exposure.
Patch Information
No vendor patch is available for CVE-2025-3723. PCMan FTP Server is not under active maintenance, and version 2.0.7 should be considered end-of-life. Affected organizations should plan replacement rather than wait for a vendor fix. Consult the VulDB CTI entry for additional threat intelligence context.
Workarounds
- Block external access to TCP port 21 at the network perimeter and limit internal access to a defined administrative subnet.
- Place the FTP service behind a VPN or zero-trust network access gateway to require authenticated tunnel access.
- Replace PCMan FTP Server with a supported alternative that receives security updates.
- If the service must remain online temporarily, deploy an application-aware firewall to drop FTP commands with oversized arguments.
# Example Windows firewall rule to block external access to FTP
netsh advfirewall firewall add rule name="Block-PCMan-FTP-External" ^
dir=in action=block protocol=TCP localport=21 ^
remoteip=any profile=any
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
