CVE-2025-4789 is a high severity buffer overflow (CVSS 7.3) in FreeFloat FTP Server 1.0. The flaw sits in the handler for the LCD command, and the record says it can be triggered remotely. No fixed version is confirmed, so take the server off untrusted networks and plan to replace it.
What's affected
The record names FreeFloat FTP Server 1.0 and the component LCD Command Handler. It says the attack can be launched remotely and that an exploit has been disclosed to the public.
I could not confirm a vendor patch or a newer release from the record, and the references are a VulDB entry and a public exploit listing, not a vendor advisory. Treat the product as unpatched. The vector lists no privileges, no user interaction and low impact scores across confidentiality, integrity and availability, which is why the score is 7.3 and not higher. Memory corruption bugs can sometimes do more than the base score suggests, so do not take comfort from the number alone.
The record does not mark it as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
Find out whether the server runs anywhere on your network. Look for the process on Windows hosts, or scan your own address space for FTP banners on port 21 with a tool you are allowed to use.
nmap -p 21 -sV 192.0.2.0/24
Replace the range with your own. A banner or service name that mentions FreeFloat means you have the product. Then ask who owns it and why it is still running. Also check whether the port is reachable from the internet, since the record describes a remote attack.
What to do now
- Locate every FreeFloat FTP Server 1.0 instance, including old lab and test machines.
- Block port 21 from the internet and from untrusted network segments at the firewall right away.
- If you still need file transfer, move to a maintained FTP or SFTP server, and prefer SFTP so credentials are not sent in clear text.
- Until the old server is gone, run it on a host with nothing else valuable on it, with the lowest possible account rights.
- Watch the host for crashes or restarts of the FTP service, which can indicate probing.
- Check the vendor site for any update and note the date you checked.
If you want a quick look at what your own projects pull in, the free in-browser dependency scan at https://gold.safeguard.sh/scan needs no setup. The Gold directory lets you look up other CVEs by id.
Why it matters
The record lists CWE-119, CWE-120 and CWE-787. Put simply, the server copies data from a command into a fixed size area of memory without checking that it fits. Extra data spills over into neighboring memory, which can crash the program or, in some cases, change what it does. The LCD handler is one of several FreeFloat command handlers that have been reported with this kind of flaw.
Old network services like this are risky mainly because nobody is watching them. The fix is rarely a patch. It is retiring the service, or putting it where only a few trusted machines can reach it. A free dependency scan will not find a standalone server like this, so an asset inventory and a network scan are what you need.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a fix for CVE-2025-4789?
I could not confirm a fixed version. The record's references are VulDB and a public exploit listing. Check the vendor site and plan to replace the server.
Is it enough to restrict port 21?
It cuts the exposure a lot, because the attack is described as remote. Replacing the server is still the real fix.
Sources
Last reviewed: 18 October 2026.
