CVE-2025-4847 is a high severity buffer overflow (CVSS 7.3) in the MLS command handler of FreeFloat FTP Server 1.0. The CVE record says it can be triggered remotely and that an exploit is public. No fixed version is listed, so take the server off untrusted networks and plan to replace it.
What's affected
The record names one product and version: FreeFloat FTP Server 1.0. The flaw sits in the component the record calls the MLS Command Handler. Manipulating input to that handler leads to a buffer overflow, and the record says the attack can be started remotely.
The weakness is filed under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-120 (Classic Buffer Overflow). The first is the broad memory safety class and the second is the classic case where data is copied into a buffer without checking its size.
No fixed version appears in the record. The references are VulDB entries and a public exploit write up, not a vendor release note. If the vendor has issued a newer build, its own site is the place to confirm it. Do not rely on a version number you cannot verify there.
The base vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L: network reachable, low complexity, no privileges, no user interaction, with limited impact on confidentiality, integrity and availability. Several other FreeFloat FTP Server 1.0 handlers were reported at the same time, so fixing one command would not make the product safe.
How to check if you're exposed
Start by finding out whether anyone runs this server. FTP servers tend to outlive the people who installed them, so check hosts as well as asset lists.
On Linux or macOS, list listening FTP ports on a host:
ss -ltnp | grep ':21'
On Windows:
netstat -ano | findstr ":21"
Match the process back to its executable and confirm the product name and version in its file properties or install folder. If it is FreeFloat FTP Server 1.0, you are in the affected set.
Then check reach. Ask your firewall team whether port 21 and the passive data port range are open from the internet or from untrusted segments. An FTP service reachable only from a management network is a smaller problem than one on a public address.
Finally, look at your FTP logs for the MLS command from unfamiliar addresses, and for sessions that end abruptly. A crash of the service is a common side effect of a memory flaw, so unexplained restarts are a signal to follow up.
What to do now
- Block inbound FTP from the internet and from untrusted networks at the firewall today.
- Stop the FreeFloat service on any host where it is not needed, and uninstall it.
- Where file transfer is still required, move to a maintained server that supports encrypted transfer, such as an SFTP service, and check that its vendor ships security fixes.
- Check the vendor site for a newer FreeFloat release and read its notes before trusting it. The record lists no fix for CVE-2025-4847.
- Review logs on the host for unexpected crashes, restarts or new files, and treat any sign of those as a reason to investigate the machine.
- Rotate any credentials that were used over this FTP service, since plain FTP sends them unencrypted.
Why it matters
A buffer overflow occurs when a program writes more data into a fixed area of memory than it was sized for, so the extra data lands on whatever sits next to it. Depending on the layout, the result ranges from a crash to an attacker steering the program. The record does not say which outcome applies here, only that the overflow is reachable over the network.
The CVE record notes that an exploit has been disclosed to the public. It does not say the flaw is exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list. This is also one of a family of reports against the same product, which points to input handling that is weak across many commands rather than one slip. When a server is old, unmaintained and exposed, the safest repair is replacement, not patching one command at a time.
The score is high, not critical, because the vector gives limited impact in each area. That does not make an FTP server on a public address a good idea. It is a service most organisations can retire.
Quick check
Is there a patch for CVE-2025-4847?
The CVE record lists no fixed version. Check the vendor site for a newer release and read its notes. If none exists, remove FreeFloat FTP Server 1.0 from untrusted networks and replace it.
Is CVE-2025-4847 being exploited in the wild?
The record says an exploit has been disclosed to the public, which is not the same as confirmed attacks. It is not on the CISA Known Exploited Vulnerabilities list. Treat any exposed instance as likely to be probed.
Sources
- NVD record for CVE-2025-4847
- fitoxs.com reference
- vuldb.com reference
- vuldb.com reference
- vuldb.com reference
Last reviewed: 18 October 2026.
