CVE-2024-0731 is a medium severity flaw in PCMan FTP Server 2.0.7, scored 5.3 by NVD. No fixed version is confirmed in the sources I could check, so limit who can reach it, watch for a vendor release, and plan an upgrade or replacement.
What's affected
The record lists PCMan FTP Server 2.0.7 as affected. The record says the PUT command handler leads to denial of service and that the attack can be initiated remotely. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. The weaknesses are CWE-404 and CWE-120.
The record's description is short and does not name a fixed release. The linked pages are public write-ups of the issue, not a vendor patch notice.
How to check if you're exposed
Find PCMan FTP Server on your hosts by looking in installed programs and running processes, and read the version. Version 2.0.7 is named. A sibling record, CVE-2024-0732, covers the STOR handler in the same version, so treat the two together.
If the product reached you inside another package, run the free in-browser dependency scan at gold.safeguard.sh/scan against your manifests to see whether it appears. For standalone software, the inventory is the check: find where it is installed, which version it is, and whether the service is reachable from outside the machine.
What to do now
- Find every installation of the product and note its version.
- Check the vendor site and project repository for a newer release, and read its notes before upgrading. Do not assume a later version is fixed without a statement that says so.
- Restrict network access to the service with firewall rules so only trusted hosts can reach it.
- Watch logs for repeated odd requests or unexpected crashes aimed at the affected component.
- If the software looks unmaintained, plan to replace it, and record the risk decision in the meantime.
Why it matters
A denial of service in a network service means a remote client can make it stop answering. Here the record ties it to input handled by the login or command processing path, and tags it with CWE-404 and CWE-120 (classic buffer overflow), which describes resources not being released or handled properly. For a file transfer or remote login service, that can interrupt anyone who relies on it, and a crash on crafted input often points to weak input handling elsewhere in the same code.
The score is medium because only availability is affected: nothing in the record says data is read or changed. Still, these small servers are often run by a single person on a spare machine, with no failover, so an outage lasts until someone notices. When no patch exists, restricting who can reach the port is the practical control.
The record also tags CWE-120, which points to a buffer being copied without a size check. That is the typical cause of a crash on a long command argument, though the record does not give further detail.
The record notes that an exploit has been disclosed publicly. That is not the same as confirmed attacks, and the record does not flag this CVE in the CISA Known Exploited Vulnerabilities list. Public detail still lowers the effort for someone to try it, which is a reason to reduce exposure early.
Quick check
Is there a fix?
None is confirmed in the sources I could check. Look for a newer release from the project and restrict access in the meantime.
How does it relate to CVE-2024-0732?
Same product and version, different command handler. Mitigations apply to both.
Sources
Last reviewed: 19 October 2026.
