CVE-2025-3376 is a High (CVSS 7.3) buffer overflow in the CONF command handler of PCMan FTP Server 2.0.7. It can be reached remotely, and the record says a public exploit exists. No fixed version is named, so do not expose this server to untrusted networks.
Records like this one come as part of a batch against the same program, each naming a different command handler.
What's affected
The record names a single product and version: PCMan FTP Server 2.0.7. The affected code is the handler for the CONF command, and the weakness is a buffer overflow, filed under CWE-119 and CWE-120.
The description says the attack may be started remotely and that an exploit has been disclosed to the public and may be used. That is how the record describes it. The CVE is not in the CISA Known Exploited Vulnerabilities list, since the record's KEV flag is false.
This is one of at least eleven records against 2.0.7 published on the same day, covering different commands. They share a product and a weakness class, so patching or retiring the server closes the whole group, and a fix for one command alone would not.
No patched release is named in the record, and I could not confirm one. Treat the lack of a named fix as a reason to plan a replacement.
How to check if you're exposed
You are exposed if PCMan FTP Server 2.0.7 runs anywhere that accepts connections from machines you do not trust.
- Find the install. On Windows, look in Program Files for a PCMan FTP Server folder, or check the running process list for the executable.
- Confirm the version in the program's own about information. Only 2.0.7 is named in the record, so note any other version you find and check it separately.
- Check which interfaces the server listens on. From a command prompt on the host,
netstat -ano | findstr :21shows whether the default FTP port is open and which process owns it. - Check your firewall and router rules for inbound access to the FTP port, and whether the server is listed on any external scan results for your address ranges.
- Review the FTP log, if logging is on, for crashes, restarts or very long command lines.
A dependency scan will not see a standalone Windows server. The free in-browser dependency scan is for libraries and manifests, so use it for the software you build and use this inventory for tools like this one.
What to do now
- Stop the service if the file transfer job it supports can be done another way.
- If it must stay, block the FTP port at the firewall for everything except the specific hosts that need it, and never expose it to the internet.
- Plan a migration to a maintained file transfer service with current security updates and encrypted transfers.
- Run the service under a low privilege account, so a crash or a worse outcome does not hand over administrator rights.
- Watch for the vendor to name a fixed build, and record the date you last checked.
- Review the host for unexpected files or accounts if it was ever reachable from outside.
Why it matters
A buffer overflow happens when a program copies more data into a fixed size memory area than the area can hold. The extra bytes land in neighbouring memory. The usual outcome is a crash. In the worse case the overwritten memory changes what the program does next. The weakness classes here, CWE-119 for memory bounds and CWE-120 for a copy that does not check input size, are among the oldest in software.
FTP servers are a poor place for them. The service is reachable by design, it runs as a long lived process, and it often runs with high privileges on a machine that holds files other people care about. A server that is not maintained and has a public exploit is a risky combination, whatever the exact command is.
The score is High, not Critical, because the record's vector shows impact rated low across confidentiality, integrity and availability. Real outcomes depend on the host and on how the process runs.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to worry about the CONF command specifically?
Not specifically. The same product and version has several records for different command handlers. Treat the server as unsafe and deal with the product, not one command.
Is there a patched release?
The record does not name one and I could not confirm one. Check the vendor or project page. If there is no fix, restrict access and replace the server.
Sources
- Gold vulnerability page for CVE-2025-3376
- The reference list in the NVD record, which points to a VulDB entry and a third party write up. Neither is linked here, and the third party page is not a vendor advisory.
Last reviewed: 18 October 2026.
