CVE-2025-4254: Pcman FTP Server Buffer Overflow Flaw

CVE-2025-4254 Overview

CVE-2025-4254 is a buffer overflow vulnerability in PCMan FTP Server 2.0.7. The flaw resides in the LIST command handler component and is triggered through manipulation of input passed to that handler. Attackers can exploit the issue remotely without authentication or user interaction. The exploit has been publicly disclosed, increasing the risk of opportunistic attacks against exposed FTP services.

The vulnerability is classified under [CWE-119] Improper Restriction of Operations within the Bounds of a Memory Buffer and [CWE-120] Classic Buffer Overflow. Successful exploitation can corrupt memory in the FTP server process, leading to service disruption or potential code execution depending on payload and environment.

Critical Impact
Remote, unauthenticated attackers can trigger a buffer overflow in the PCMan FTP Server 2.0.7 LIST command handler, with public exploit details available.

Affected Products

PCMan FTP Server 2.0.7
Deployments exposing the FTP LIST command to untrusted networks
Legacy Windows hosts running PCMan FTP Server as a file transfer service

Discovery Timeline

2025-05-05 - CVE-2025-4254 published to NVD
2025-05-16 - Last updated in NVD database

Technical Details for CVE-2025-4254

Vulnerability Analysis

The vulnerability is a classic buffer overflow in the LIST command handler of PCMan FTP Server 2.0.7. The handler processes client-supplied arguments to the FTP LIST command without properly enforcing bounds on the input length. When an attacker submits an overly long argument, the data overruns the fixed-size buffer allocated for command parsing.

The overflow corrupts adjacent stack or heap memory in the FTP server process. Depending on the runtime layout, this can overwrite saved return addresses, function pointers, or structured exception handlers. The result ranges from a service crash to attacker-controlled execution flow within the server process.

PCMan FTP Server is a lightweight Windows FTP service often used in lab and small-deployment scenarios. Historical advisories have documented similar buffer overflows in other PCMan FTP command handlers, indicating a recurring pattern of unsafe string handling. The current EPSS score is 0.649% with a percentile of 71.015, reflecting moderate predicted exploitation activity.

Root Cause

The root cause is missing length validation on input passed to the LIST command handler. The implementation copies attacker-supplied data into a fixed-size buffer using unsafe string operations. No bounds check exists between the network input layer and the destination buffer, allowing memory adjacent to the buffer to be overwritten.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction in many deployment scenarios. An attacker connects to the FTP service on TCP port 21, completes the protocol handshake, and issues a LIST command with an oversized argument. The malformed command triggers the overflow inside the server process. The vulnerability manifests during command parsing. See the referenced Fitoxs Exploit Document and VulDB entry #307358 for additional technical context.

Detection Methods for CVE-2025-4254

Indicators of Compromise

Unexpected termination or restart of the PCMan FTP Server process on Windows hosts
FTP sessions containing LIST commands with abnormally long arguments or non-printable characters
Crash dumps or Windows Error Reporting events tied to the PCMan FTP Server executable
Outbound connections originating from the FTP server process to attacker-controlled hosts following anomalous LIST traffic

Detection Strategies

Inspect FTP traffic for LIST command arguments exceeding typical path lengths, such as several hundred bytes or more
Correlate FTP process crashes with preceding network traffic to identify exploit attempts
Apply intrusion detection signatures that flag oversized FTP command parameters and shellcode-like byte patterns

Monitoring Recommendations

Enable verbose FTP server logging and forward logs to a centralized analytics platform
Monitor for child process creation or shell spawning from the PCMan FTP Server executable
Alert on inbound connections to TCP port 21 from untrusted networks or geographies

How to Mitigate CVE-2025-4254

Immediate Actions Required

Restrict network access to the PCMan FTP Server by placing it behind a firewall and limiting source IP addresses to trusted ranges
Disable or decommission PCMan FTP Server 2.0.7 instances that are not actively required
Replace PCMan FTP Server with a maintained FTP or SFTP solution that receives security updates

Patch Information

No vendor security patch is referenced in the available advisory data for PCMan FTP Server 2.0.7. Given the legacy status of the product and the absence of vendor remediation, migration to a supported file transfer server is the recommended long-term action. Track updates through the VulDB advisory for any subsequent vendor response.

Workarounds

Block external access to TCP port 21 at the perimeter firewall and require VPN access for legitimate FTP users
Deploy a network-level filter that drops FTP LIST commands exceeding a safe argument length
Run the FTP service under a low-privilege account and isolate it on a segmented network to limit blast radius

bash

# Example Windows Firewall rule restricting FTP access to a trusted subnet
netsh advfirewall firewall add rule name="Restrict PCMan FTP" \
    dir=in action=block protocol=TCP localport=21 remoteip=any
netsh advfirewall firewall add rule name="Allow Trusted FTP" \
    dir=in action=allow protocol=TCP localport=21 remoteip=10.0.0.0/24