CVE-2024-0889 is a medium severity flaw (CVSS 5.3) in Golden FTP Server. The record names no fixed version. This guide covers who is affected, how to check your exposure, and what to do now.
What's affected
Kmint21 Golden FTP Server 2.02b, in the PASV command handler.
The record gives a CVSS base score of 5.3 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. The weakness class is CWE-404.
The record describes the problem as unknown processing in the PASV command handler that leads to a denial of service. A Packet Storm entry with a public proof of concept is listed among the references.
The record says exploit details have been disclosed publicly, so assume that attackers can learn how the weakness works. The record names no fixed version. Check the vendor site for a newer release.
How to check if you're exposed
Open the server console and read the version. From a scan host, nmap -sV -p 21 your-host often reports the FTP banner, which may include the product name.
A free in-browser dependency scan at gold.safeguard.sh/scan can show whether a software package in your own projects matches this CVE, and the Gold directory entry for CVE-2024-0889 keeps the record details in one place. Reachability analysis helps you separate installations where the vulnerable code can actually be hit from those where it sits unused.
For hardware and appliances, no scanner will find them unless they are in an inventory, so start with a list of every device and application of this kind on your network.
What to do now
- Identify every instance of Golden FTP Server in your environment, including test and forgotten systems.
- Compare the version you found with the affected range above.
- Look for a fixed release from the vendor or project. The record names no fixed version.
- Apply mitigations while you wait: restrict FTP to trusted addresses, prefer SFTP where you can, and put the service behind a firewall rule that limits who can open control connections.
- Review logs around the affected component for unusual requests.
- Record the decision and a re-check date in your vulnerability tracker.
Why it matters
The weakness is filed as CWE-404, improper resource shutdown or release. In practice that means a service takes input it should survive, then fails to clean up or keep running, so a remote sender can take it offline. The impact is availability only. The CVSS vector in the record shows no confidentiality or integrity impact.
A denial of service bug like this is rarely urgent on its own, but the service often sits on a network port that is easy to reach. If the product is part of something people depend on, a crash is still an outage, and repeated crashes can hide other activity in the noise.
The record shows this CVE is not in the CISA Known Exploited Vulnerabilities catalog, and none of the pages used for this article report exploitation in the wild.
Quick check
Is this a data theft bug?
No. The record scores availability impact only, with no confidentiality or integrity impact.
Where can I confirm the fixed version?
Check the vendor or project advisory first. The record names no fixed version. This article is based on the NVD record and the pages listed under Sources.
Sources
- https://packetstormsecurity.com/files/176661/Golden-FTP-Server-2.02b-Denial-Of-Service.html
- https://vuldb.com/?ctiid.252041
- https://vuldb.com/?id.252041
- Safeguard Gold record for CVE-2024-0889
Last reviewed: 19 October 2026.
