CVE-2025-5073 is a high severity (CVSS 7.3) buffer overflow in the MKDIR command handler of FreeFloat FTP Server 1.0. The record says it can be reached remotely and that exploit details are public. No fixed version is confirmed, so retire the server or keep it off any untrusted network.
What's affected
FreeFloat FTP Server version 1.0, per the record. The vulnerable code is the handler for the MKDIR command. The record does not describe the exact function and does not give a patched release.
The references are a VulDB entry and a public exploit listing. There is no vendor advisory among them, and I could not confirm that the vendor still ships updates. Check the vendor's site before assuming a fix exists, and treat every copy of version 1.0 as vulnerable until you know otherwise.
The same product has near identical entries for other commands: CVE-2025-5053 (MDIR), CVE-2025-5074 (PROMPT), CVE-2025-5075 (DEBUG), CVE-2025-5076 (SEND), CVE-2025-5109 (STATUS), CVE-2025-5110 (VERBOSE), CVE-2025-5111 (TYPE), CVE-2025-5112 (MGET).
How to check if you're exposed
Start with an inventory. FreeFloat FTP Server runs on Windows, often as a leftover from an old file transfer job. On a Windows host you can search for the executable:
Get-ChildItem -Path C:\ -Recurse -Filter "*freefloat*" -ErrorAction SilentlyContinue
Then find which hosts answer on the FTP port. Only scan networks you own or have written permission to test:
nmap -sV -p 21 --open 10.0.0.0/24
The service banner often names the product. If you find a match, check whether the port is open to the internet, and ask who still depends on it.
Reachability analysis helps with libraries, because it asks whether your code actually calls the vulnerable function. For a standalone server product like this one, the question is simpler: is it installed, and can anyone reach it?
What to do now
- List every FreeFloat FTP Server in your estate and the process that uses it.
- Ask the vendor whether a fixed build exists. If the answer is no or nothing comes back, plan the replacement.
- Move the transfer job to a maintained server that supports encrypted transfer such as SFTP.
- Until then, block port 21 from the internet and allow only the specific source addresses that need it.
- If the host was exposed, review it for unexpected processes, new accounts and odd outbound connections.
Why it matters
The record classifies this as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-120 (Classic Buffer Overflow). The weakness is a classic memory safety bug. The code that handles this command trusts the length of what the client sends. FTP is a text protocol where every command has an argument the client controls, so each handler is a separate place where a missing length check can hide.
This is one of several FreeFloat FTP Server 1.0 entries published within days of each other, each for a different command handler. Read them as one finding: the command parser in this server has no consistent bounds checking.
The record does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild. It does say the exploit has been disclosed publicly, which lowers the effort for anyone who finds an exposed server. You can also run the free in-browser dependency scan at gold.safeguard.sh/scan, which checks the packages your own projects use against the Gold directory. It will not find a commercial product installed on a server, so pair it with an inventory of what runs where.
Quick check
Is there a patch for FreeFloat FTP Server 1.0?
I could not confirm one from the sources available. The record lists no fixed version, so check with the vendor and plan to replace the server.
Does an attacker need an account to reach the MKDIR handler?
The record says the attack can be launched remotely, and the CVSS vector lists no privileges required. The record does not spell out the login state, so do not rely on authentication as a defence.
Sources
Last reviewed: 18 October 2026.
