CVE-2025-5634 is a high severity buffer overflow flaw (CVSS 7.3) in PCMan FTP Server 2.0.7. It is reachable over the network and needs no account. No fixed version is named in the record, so isolate the product, restrict access and check the vendor for an update.
What's affected
The record lists PCMan FTP Server 2.0.7. The affected component is the NOOP command handler, reached by sending the NOOP command to the server over the network.
The NVD description was published on 2025-06-05. NVD rates it HIGH with a base score of 7.3. The vector shows attack complexity low, no user interaction, and impact of confidentiality low, integrity low, availability low.
Fixed versions: not stated in the record or in the pages we could read. We cannot confirm a patched release, so the vendor's advisory page or support channel should be checked directly. Do not assume a later version number is safe without a vendor statement.
The record also says the exploit has been disclosed to the public and may be used. It is not marked as exploited in the wild: the CISA Known Exploited Vulnerabilities flag in the record is false.
How to check if you're exposed
Start with an inventory. Check whether PCMan FTP Server is installed on any Windows host, including old lab machines and file transfer boxes that nobody owns any more. The version should read 2.0.7.
Then see whether the service is listening. On the host, run:
netstat -an | findstr :21
From your perimeter, confirm whether TCP port 21 on that host is reachable from outside. A listener on all interfaces with an internet route is the worst case. A listener limited to a management network is a much smaller problem.
What to do now
- Stop exposing PCMan FTP Server to untrusted networks. Block TCP port 21 at the firewall unless a specific partner needs it.
- Check the vendor or download page for a newer release. None is named in the record, so confirm before trusting any build.
- Move file transfers to a maintained server that is patched on a schedule, and prefer an encrypted protocol such as SFTP.
- Run the service under an account with the fewest rights possible, never as an administrator.
- Watch for service crashes or restarts, which can be the first visible sign of memory corruption attempts.
- Retire the host if nobody can say why it is running.
Why it matters
This is a buffer overflow. The classes involved are CWE-119 (improper restriction of operations within the bounds of a memory buffer); CWE-120 (a classic buffer copy without checking the size of the input). The server copies data from a network command into a fixed size memory area without checking that it fits. Oversized input can overwrite memory next to the buffer.
The outcome ranges from a crashed service to code running with the rights of the FTP server process, depending on the build and the host. The record does not say which, and we will not guess. What it does say is that the attack can be started remotely and that a public exploit exists.
FTP servers like this are often installed once and forgotten. They sit on old Windows hosts, listen on a well known port and carry no automatic updates. That combination is why exposure checks matter more than the score.
Quick check
Is a patch available?
No fixed version appears in the record. Check the download page and consider moving to a maintained server.
Does blocking port 21 help?
Yes, it removes the network path for people outside the allowed range. It does not fix the bug for anyone who can still reach the service.
Sources
Check your own dependencies with the free in-browser scan at gold.safeguard.sh/scan. It reads manifests you give it, so it will not see a router or a standalone server, but it is a quick way to cover the code you ship.
Last reviewed: 18 October 2026.
