CVE-2025-3680 is a High severity (CVSS 7.3) buffer overflow in the LANG command handler of PCMan FTP Server 2.0.7. It can be triggered remotely without a login, and the exploit is public. The record names no fixed version, so stop using the server or isolate it.
What's affected
The record names one product and version: PCMan FTP Server 2.0.7. The affected component is the LANG command handler.
The record does not name a fixed release, and I found no vendor advisory. The record gives no sign of a vendor fix, so plan on replacing the server and not on waiting for a patch. Several overflows were reported in the same version on the same day, so fixing one command would not make it safe.
The record says the exploit has been disclosed to the public and may be used. It does not mark the CVE as exploited in the wild in CISA's catalog.
How to check if you're exposed
Find out whether the server is running anywhere. On Windows, look for the process and the install folder, and check which hosts listen on TCP port 21 on your networks. A port scan from your own scanner across internal ranges will show FTP listeners. The product name usually appears in the FTP banner, and the banner can show the version, so confirm 2.0.7.
Also search software inventories, old build images and file shares for the program. Small utilities like this tend to persist on lab machines and legacy file transfer hosts long after the project that needed them ended.
What to do now
- Locate every PCMan FTP Server instance and confirm the version.
- Stop and remove the service if you can. Move file transfers to a maintained server that supports SFTP or FTPS.
- If it must stay for now, block inbound access to port 21 at the firewall, allow only the specific client addresses that need it, and do not expose it to the internet.
- Run the service under a low privilege account on a host with nothing else valuable on it.
- Check the host for signs of compromise if it was reachable from untrusted networks.
Why it matters
The weakness is CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-120 (Classic Buffer Overflow). The LANG command handler copies data supplied by the client into a fixed size area of memory without checking how long it is. Data that is too long writes past the end of that area and can crash the program or, in the worst case, let an attacker run code.
The vector is network, low complexity, no privileges and no user interaction, with low impact figures for each of confidentiality, integrity and availability, which is why the score is 7.3 and not higher. Do not read the low figures as a sign of safety, since memory corruption in a network service running as a privileged user can lead to full control of the host.
This CVE is one of nine PCMan FTP Server 2.0.7 overflows published together: CVE-2025-3678 (HELP), CVE-2025-3679 (HOST), CVE-2025-3681 (MODE), CVE-2025-3682 (PASV), CVE-2025-3683 (SIZE), CVE-2025-3723 (MDTM), CVE-2025-3724 (DIR), CVE-2025-3725 (MIC). Each affects a different command, which suggests that the same unsafe pattern is repeated through the code. When a single product shows that pattern, the right response is to replace it.
Quick check
Is there a patch for CVE-2025-3680?
The record names no fixed version and I found no vendor advisory. Replace the server or isolate it.
Is it exploited in the wild?
The record does not flag it as a CISA Known Exploited Vulnerability. It does say the exploit is public, so the barrier to abuse is low.
Sources
Last reviewed: 18 October 2026.
