CVE-2025-4288 is a high severity (CVSS 7.3) buffer overflow in the RNFR command handler of PCMan FTP Server 2.0.7. A remote client can send a crafted command that overruns memory. The record names no fixed version, so retire the server or isolate it tightly.
What's affected
PCMan FTP Server version 2.0.7, per the record. The flaw is in the component that handles the RNFR command, which is the first half of a rename, which names the file to be renamed. The CVE text says the manipulation leads to a buffer overflow and that the attack may be launched remotely.
The weakness is tagged CWE-119, improper restriction of operations within the bounds of a memory buffer, and CWE-120, the classic copy without checking the size of the input. The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L: network reachable, low complexity, no privileges and no user interaction, with partial impact on confidentiality, integrity and availability.
The record does not list a fixed version, and I could not confirm that a patched release exists. Check with the project before assuming one does.
This is one of several overflows in the same product from the same disclosure period. Others in this range are CVE-2025-4254, CVE-2025-4255, CVE-2025-4289, CVE-2025-4290. Each covers a different command handler, which points to a pattern of unsafe input handling across the server rather than a single slip. Fixing one command would not make the server safe.
How to check if you're exposed
PCMan FTP Server is a Windows program. Start by finding it. Check installed programs and running processes on Windows hosts. In PowerShell:
Get-Process | Where-Object { $_.ProcessName -like "*PCMan*" }
Then see which hosts answer on the FTP port. Only scan networks you own or have permission to test.
nmap -sV -p 21 --open 10.0.0.0/24
The banner may name the server and its version. If the version shown is 2.0.7, treat the host as affected. If the banner is hidden, check the executable's file properties on the host itself.
Also check the firewall. A server that only answers on a private network is a smaller problem than one reachable from the internet.
What to do now
- Inventory every PCMan FTP Server install, including old file transfer boxes that no one owns any more.
- Stop the service if the transfers can move elsewhere. FTP sends credentials and data in clear text, so replacing it with SFTP is a gain on its own.
- If it must run, restrict the FTP port to named source addresses with the host firewall or a network ACL.
- Turn off anonymous access and remove unused accounts.
- Run the service under a low privilege account, so that a crash or hijack does not give full control of the host.
- Watch for service crashes and restarts. Overflow attempts often cause a crash first.
- Check the project site for a newer release and record what you find against this CVE.
Why it matters
A buffer overflow happens when a program copies more data into a fixed size block of memory than the block can hold. The extra bytes overwrite whatever sits next to it. In the worst case an attacker steers the program into running their own code. The record does not describe the outcome in that detail, and this post does not either.
The CVE text says the exploit has been disclosed to the public and may be used. The record does not flag the CVE as listed in CISA's Known Exploited Vulnerabilities catalog (KEV), so there is no confirmation here of attacks in the wild. A public exploit still makes scanning for old FTP servers cheap, so exposure on the internet is the main thing to remove.
Quick check
Does the same issue affect other PCMan commands?
The record for this CVE names only the RNFR handler. Other command handlers have their own CVEs in this range, which is why replacing or isolating the server is safer than waiting for command by command fixes.
Is this exploited in the wild?
The record says an exploit is public, but it does not list the CVE in CISA KEV. Treat it as likely to be probed, and do not read that as proof of attacks.
Sources
- Gold entry for CVE-2025-4288
- Gold entry for CWE-119
- Gold entry for CWE-120
- VulDB entry, listed in the CVE record
The reference pages in the CVE record block automated access, so I could not read their full text. The affected version and the lack of a confirmed fix come from the record.
Last reviewed: 18 October 2026.
