CVE-2025-4871: High Buffer Overflow in PCMan FTP Server

CVE-2025-4871 is a high severity buffer overflow (CVSS 7.3) in PCMan FTP Server 2.0.7. It sits in the REST command handler, and the record says the attack can be launched remotely. The record names no fixed version. Retire the server or replace it with a maintained one, and close the FTP port to untrusted networks.

What's affected

The CVE record lists PCMan FTP Server 2.0.7, in the REST command handler. The record says the manipulation leads to a buffer overflow, that the attack may be started remotely, and that an exploit has been disclosed to the public. The public write up it points to is a short text file on GitHub, which I opened only to confirm what it is. This post does not describe it.

No fixed version is named in the record. Check the vendor or project site, but plan on the basis that no patch will come.

Earlier CVEs have been recorded against both FreeFloat FTP Server and PCMan FTP Server, so a new one in the same product says something about the product, not just about one command.

How to check if you're exposed

Find FTP services on your network. A port scan of your own address ranges for the FTP port will list the hosts:

nmap -p 21 --open 10.0.0.0/24

Replace the range with your own. For each host, check which server software answers. The banner usually shows the product and version, which you can read with a plain connection from a trusted admin machine. If it shows PCMan FTP Server 2.0.7, you are in scope.

On Windows hosts, look in the installed programs list and in running services for the product name, and on other systems check the process list. Do not forget lab machines, old file transfer boxes and machines set up by a contractor years ago.

Check firewall rules for the FTP port. If it is open to the internet, treat this as urgent.

What to do now

1. List every host that runs PCMan FTP Server 2.0.7.
2. Close the FTP port at the firewall for any network that does not need it, starting with the internet.
3. Replace the server with a maintained product, and prefer SFTP over plain FTP so that credentials are encrypted in transit.
4. If you must keep the server for a short time, run it on an isolated host with no sensitive data, and with a service account that has minimal rights.
5. Review the host for signs of compromise, such as new accounts or scheduled tasks.

Why it matters

The record lists CWE-119, improper restriction of operations within the bounds of a memory buffer, and CWE-120, a classic buffer copy without checking the size of the input. The server copies data from a network command into a fixed size buffer without checking the length, so too much data overwrites memory next to it. In memory unsafe programs, that can crash the service or, in the worst case, change what the program runs.

The vector in the record shows network reach with low complexity and no privileges, with low impact scores for each of confidentiality, integrity and availability. Those low numbers reflect how the scoring formula treats the unknowns in a short report, so do not read them as a promise of limited harm.

Old FTP servers are often left running because they work. That is the real exposure. The issue is not listed in the CISA Known Exploited Vulnerabilities catalogue. A scan of your network for outdated server software is the practical way to find these hosts, and the Gold directory entry for the CVE gives you the record in one place.

Quick check

Sources

• Gold page for CVE-2025-4871

Last reviewed: 18 October 2026.