CVE-2025-4079 is a high buffer overflow flaw in PCMan FTP Server, with a CVSS score of 7.3. The record names no fixed version. Treat any instance reachable from untrusted networks as exposed until you have confirmed the fix, and review your logs for unexpected requests.
What's affected
- Product: PCMan FTP Server up to version 2.0.7, a Windows FTP server.
- Fixed version: The record names no fixed version.
- Severity: High, CVSS 7.3 (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
- Weakness: CWE-119 and CWE-120.
- Published: 2025-04-29.
The record puts the flaw in the RENAME command handler, where a manipulated input leads to a buffer overflow. It says the attack can be launched remotely and that the exploit has been disclosed to the public.
This is rated High at 7.3. The record also lists a public exploit write-up among its references. The record does not say the flaw is exploited in the wild, and it is not in the CISA KEV catalog.
How to check if you're exposed
Find out whether the server is running and who can reach it. On the Windows host:
netstat -ano | findstr :21
That shows whether anything is listening on the default FTP port. Then confirm the installed version, since the record covers versions up to 2.0.7.
You can also run your dependency manifests and container images through the free in-browser scan to see which known CVEs affect the packages you ship. It will not find a flaw inside a vendor appliance or an unmanaged install, so keep an inventory of those too.
What to do now
- Identify every copy of PCMan FTP Server you run, including test and forgotten ones.
- Since no fix is named, the safest step is to retire PCMan FTP Server for a maintained alternative, or at least stop exposing it to the internet.
- Until that is done, remove public access where you can. Put the application behind a VPN, a network allow list or a web application firewall rule, and watch the access and database logs for unusual requests to the endpoint named above.
- Record the outcome, including the date, the version you ended on and who confirmed it, so a later audit has something to read.
- Add the product to your continuous monitoring so a future CVE against it reaches you without a manual search.
Why it matters
A buffer overflow happens when a program copies more data into a fixed-size memory area than it can hold. The extra bytes overwrite neighbouring memory, which can crash the service or, in the worst case, let an attacker change what it executes. The classes are catalogued as CWE-119 (improper restriction of operations within the bounds of a memory buffer) and CWE-120 (classic buffer overflow).
Here the trigger sits in a protocol command handler, so it can be reached by anyone who can open a connection to the FTP port. Modern memory-safe code and compiler protections reduce this risk, but older or unmaintained servers often lack both.
The record's KEV flag is false, so CISA does not list it as known to be exploited, and nothing in the sources here says it is being exploited in the wild.
Try it yourself
See how the reachability cuts the noise step works in practice.
Click through it at your own pace, or open it full screen.
Quick check
What does the score of 7.3 mean for PCMan FTP Server?
The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L reads as network reachable, low complexity, no privileges and no user interaction. The impact ratings are confidentiality low, integrity low, availability low. Use it to rank the work, then confirm exposure for your own deployment.
Why does an FTP command handler matter here?
FTP servers parse commands sent by remote clients. A length check missing in one handler means a long argument can overrun a buffer, and the attacker only needs network access to the FTP port.
Sources
Last reviewed: 18 October 2026.
