CVE-2024-0547 is a medium severity (5.3) denial of service in Ability FTP Server. It affects Ability FTP Server 2.34. The record names no fixed version. Treat the product as exposed until you confirm the version and restrict who can reach it.
What's affected
- Product and location: Ability FTP Server 2.34, in the APPE command handler.
- The attack is remote and an exploit is public according to the record.
- Fixed version: The record names no fixed version.
- Severity: NVD scores it 5.3 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.
- Published: 2024-01-15.
- The record says the exploit has been disclosed to the public and may be used.
How to check if you're exposed
- Run your asset inventory or a port check for the FTP listener on port 21 and find any host running this product.
- Read the version in the program's about box or install folder and compare it with the one in the record.
- Confirm whether the service is reachable from outside your network.
Keep a record of what you find. An inventory that lists the product, version and owner turns the next advisory into a lookup instead of a search. Safeguard's dependency scan runs in the browser for the software you build.
What to do now
- Confirm whether you run the product and which version, using the checks above.
- Look for a vendor update. If none exists, assume the product stays unpatched.
- Do not expose the FTP service to the internet.
- Replace the product with a maintained file transfer service.
- Restrict the listener to the hosts that need it.
- Run the free dependency scan at gold.safeguard.sh/scan on projects of yours that bundle similar components, and look the CVE up in the Gold directory.
Why it matters
The weakness is CWE-404, improper resource shutdown or release. A malformed or unexpected command sent to the FTP service can leave it unable to keep serving clients. The record scores the impact as availability only, with no data exposure.
Public exploit write ups exist for this software, as the record references show, and the products are old desktop style FTP servers. If one is still running, ask first whether it needs to exist at all.
The record lists CWE-404 for this CVE and carries no CISA Known Exploited Vulnerabilities flag. The scores in this post come from NVD and may be revised.
Quick check
Does this let someone read files?
No. The record describes a denial of service only. Availability is affected, not confidentiality or integrity.
Sources
I did not fetch the pages below, so every statement here comes from the NVD record. The VulDB entry and researcher write ups were not independently confirmed.
- https://packetstormsecurity.com/files/163079/Ability-FTP-Server-2.34-Denial-Of-Service.html
- https://vuldb.com/?ctiid.250717
- https://vuldb.com/?id.250717
Last reviewed: 19 October 2026.
